diff --git a/README.md b/README.md index c974c9e..08042cf 100644 --- a/README.md +++ b/README.md @@ -51,8 +51,9 @@ TODO. ### Installing the Configuration -1. Copy/clone the configuration over to the host to install. +1. Copy/clone the configuration over to the host to install and `cd` into it. 2. Copy the sops key data to the host you are installing on (sops `key.txt` and `ssh_host_ed25519_key` to `/var/lib/sops-nix/`) 3. Run `sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount -f "$PWD#hostname"` to prepare the disk, replacing `hostname` with the host you want to install (ex. `andromeda`). -4. Before installing, prepare sops inside the mounted filesystem: `sudo mkdir -p /mnt/persist/var/lib/sops-nix/; sudo cp -r /var/lib/sops-nix/ /mnt/persist/var/lib/sops-nix/` +4. Before installing, prepare sops inside the mounted filesystem: `sudo mkdir -p /mnt/persist/var/lib/sops-nix/; sudo cp -r /var/lib/sops-nix/ /mnt/persist/var/lib/; sudo chmod -R 755 /mnt/persist/var/lib/sops-nix/` 5. Run `sudo nixos-install --flake "$PWD#hostname"` to install the OS, replacing `hostname` with the host you want to install (ex. `andromeda`). +6. Copy the current configuration into `/etc/nixos`: `sudo cp -r $PWD/. /mnt/persist/etc/nixos` diff --git a/hosts/andromeda/hardware-configuration.nix b/hosts/andromeda/hardware-configuration.nix index 6e470e7..b6935b7 100755 --- a/hosts/andromeda/hardware-configuration.nix +++ b/hosts/andromeda/hardware-configuration.nix @@ -9,12 +9,13 @@ ... }: { imports = [ - (modulesPath + "/installer/scan/not-detected.nix") + (modulesPath + "/profiles/qemu-guest.nix") ]; - boot.initrd.availableKernelModules = ["xhci_pci" "usbhid" "uas" "sd_mod"]; - boot.initrd.kernelModules = ["dm-snapshot"]; - boot.kernelModules = []; + boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's @@ -23,5 +24,4 @@ networking.useDHCP = lib.mkDefault true; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/system/disko.nix b/system/disko.nix index 225480d..a586c7a 100755 --- a/system/disko.nix +++ b/system/disko.nix @@ -21,28 +21,38 @@ size = "100%"; name = "NixOS"; content = { - type = "btrfs"; - extraArgs = ["-f"]; - subvolumes = { - root = { - name = "root"; - mountpoint = "/"; - }; - persist = { - name = "persist"; - mountpoint = "/persist"; - mountOptions = ["subvol=persist" "noatime"]; - }; - home = { - name = "home"; - mountpoint = "/home"; - mountOptions = ["subvol=home" "noatime"]; - }; - nix = { - name = "nix"; - mountpoint = "/nix"; - mountOptions = ["compress=zstd" "subvol=nix" "noatime"]; - }; + type = "lvm_pv"; + vg = "root_vg"; + }; + }; + }; + }; + }; + }; + lvm_vg = { + root_vg = { + type = "lvm_vg"; + lvs = { + root = { + size = "100%FREE"; + content = { + type = "btrfs"; + extraArgs = ["-f"]; + subvolumes = { + "/root" = { + mountpoint = "/"; + }; + "/persist" = { + mountpoint = "/persist"; + mountOptions = ["subvol=persist" "noatime"]; + }; + "/home" = { + mountpoint = "/home"; + mountOptions = ["subvol=home" "noatime"]; + }; + "/nix" = { + mountpoint = "/nix"; + mountOptions = ["subvol=nix" "noatime"]; }; }; }; diff --git a/system/sops.nix b/system/sops.nix index 2a6c84a..b135691 100755 --- a/system/sops.nix +++ b/system/sops.nix @@ -9,10 +9,10 @@ in sops = { defaultSopsFile = "${secretspath}/secrets.yaml"; age = { - # I'd prefer different OpenSSH keys for different hosts so I'm not 100% screwed if one of my devices get compromised. - # Therefore, we set a custom path for the sops key. - sshKeyPaths = ["/var/lib/sops-nix/ssh_host_ed25519_key"]; - keyFile = "/var/lib/sops-nix/key.txt"; + # I'd prefer different OpenSSH keys for different hosts so I'm not 100% screwed if one of my devices get compromised (SSH traffic potentially being decrypted and analyzed). + # Therefore, we set a custom path for the sops key & let the SSH key be generated automagically. + sshKeyPaths = ["/persist/var/lib/sops-nix/ssh_host_ed25519_key"]; + keyFile = "/persist/var/lib/sops-nix/key.txt"; generateKey = false; }; secrets = {