Something went wrong. Try again.
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122# Setup# Presumes pre-formatted harddrives BOOT=/dev/sda1DISK=/dev/sda2
dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4
echo "Creating LUKS partitions..."# Enter the passphrase which is used to unlock disk. You will enter this in grub on every bootcryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK# Add a second key which will be used by nixos. You will need to enter the pasphrase from previous stepcryptsetup luksAddKey $DISK keyfile0.bincryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin
# Create the LVMecho "Creating LVM partitions..."pvcreate /dev/mapper/crypted-nixosvgcreate vg /dev/mapper/crypted-nixoslvcreate -L 4G -n swap vglvcreate -l '100%FREE' -n root vg
# Format the disksecho "Formatting disks..."mkfs.fat -F 32 $BOOTmkswap -L swap /dev/vg/swapmkfs.ext4 -L root /dev/vg/root# mkfs.ext4 -L data /dev/mapper/crypted-data
echo "Mounting drives..."mount /dev/vg/root /mntmkdir -p /mnt/boot/efimount $BOOT /mnt/boot/efiswapon /dev/vg/swap
# Copy the keys
mkdir -p /mnt/etc/secrets/initrd/cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrdchmod 000 /mnt/etc/secrets/initrd/keyfile*.bin
# Generate and edit configuration
echo "Generating NixOS config..."nixos-generate-config --root /mnt
# TODO: neds to get the uuid of each of the disks # UUID=$(blkid) echo "Extending NixOS config..."cat >> /mnt/etc/nixos/configuration.nix <<'endmsg' boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.efiSysMountPoint = "/boot/efi"; boot.loader.grub = { enable = true; device = "nodev"; version = 2; efiSupport = true; enableCryptodisk = true; }; boot.initrd = { luks.devices."root" = { # UPDATE ME device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2 preLVM = true; keyFile = "/keyfile0.bin"; allowDiscards = true; }; secrets = { # Create /mnt/etc/secrets/initrd directory and copy keys to it "keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin"; "keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin"; }; };
# Data mount # This is all wrong for box for now # fileSystems."/data" = { # device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data # encrypted = { # enable = true; # label = "crypted-data"; # blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1 # keyFile = "/keyfile1.bin"; # }; # };
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
nix = { package = pkgs.nixUnstable; extraOptions = '' experimental-features = nix-command flakes ''; };
users.users.anish = { isNormalUser = true; hashedPassword = "MVHHpy9gbe3ow"; extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ]; }; security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
services.openssh.enable = true;
# This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave # this value at the release version of the first install of this system. # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). system.stateVersion = "22.11"; # Did you read the comment?}
endmsg
# sudo nixos-install