summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGregor Kleen <gkleen@yggdrasil.li>2026-09-22 21:10:27 +0200
committerGregor Kleen <gkleen@yggdrasil.li>2026-09-22 21:10:27 +0200
commit722004beea7ac07f9a5d2eddc001037df9046911 (patch)
tree8b71df309f695090ebd4f1de17f19c0f2bd32663
parent06fe427967cb3076ca992566da9615f34523549d (diff)
downloadnixos-722004beea7ac07f9a5d2eddc001037df9046911.tar
nixos-722004beea7ac07f9a5d2eddc001037df9046911.tar.gz
nixos-722004beea7ac07f9a5d2eddc001037df9046911.tar.bz2
nixos-722004beea7ac07f9a5d2eddc001037df9046911.tar.xz
nixos-722004beea7ac07f9a5d2eddc001037df9046911.zip
...
Diffstat
-rw-r--r--hosts/skadhi/default.nix17
-rw-r--r--hosts/skadhi/fs.nix82
-rw-r--r--hosts/skadhi/hw.nix59
-rw-r--r--system-profiles/tmpfs-root.nix37
4 files changed, 107 insertions, 88 deletions
diff --git a/hosts/skadhi/default.nix b/hosts/skadhi/default.nix
index 62823488..847f9e8f 100644
--- a/hosts/skadhi/default.nix
+++ b/hosts/skadhi/default.nix
@@ -1,7 +1,7 @@
1{ flake, flakeInputs, pkgs, config, lib, ... }: 1{ flake, flakeInputs, pkgs, config, lib, ... }:
2{ 2{
3 imports = with flake.nixosModules.systemProfiles; [ 3 imports = with flake.nixosModules.systemProfiles; [
4 ./hw.nix 4 ./hw.nix ./fs.nix
5 tmpfs-root default-locale openssh niri-unstable networkmanager lanzaboote zswap 5 tmpfs-root default-locale openssh niri-unstable networkmanager lanzaboote zswap
6 flakeInputs.nixVirt.nixosModules.default 6 flakeInputs.nixVirt.nixosModules.default
7 ]; 7 ];
@@ -9,21 +9,6 @@
9 config = { 9 config = {
10 system.stateVersion = "26.05"; 10 system.stateVersion = "26.05";
11 11
12 fileSystems."/persistent".neededForBoot = true;
13 environment.persistence."/persistent" = {
14 hideMounts = true;
15 directories = [
16 "/nix"
17 "/root"
18 "/var/log"
19 "/var/lib/nixos"
20 "/var/lib/sops-nix"
21 "/var/lib/systemd"
22 config.boot.lanzaboote.pkiBundle
23 ];
24 timezone = true;
25 };
26
27 boot = { 12 boot = {
28 initrd = { 13 initrd = {
29 systemd = { 14 systemd = {
diff --git a/hosts/skadhi/fs.nix b/hosts/skadhi/fs.nix
new file mode 100644
index 00000000..cbeef6f9
--- /dev/null
+++ b/hosts/skadhi/fs.nix
@@ -0,0 +1,82 @@
1{ flake, flakeInputs, pkgs, config, lib, ... }:
2{
3 imports = with flake.nixosModules.systemProfiles; [
4 disko
5 ];
6
7 config = {
8 fileSystems."/persistent".neededForBoot = true;
9 environment.persistence."/persistent" = {
10 hideMounts = true;
11 directories = [
12 "/nix"
13 "/root"
14 "/var/log"
15 "/var/lib/nixos"
16 "/var/lib/sops-nix"
17 "/var/lib/systemd"
18 config.boot.lanzaboote.pkiBundle
19 ];
20 timezone = true;
21 };
22
23 disko.devices = {
24 disk.nvm = {
25 type = "disk";
26 device = "/dev/nvme0n1";
27 content = {
28 type = "gpt";
29 partitions = {
30 ESP = {
31 size = "512M";
32 type = "EF00";
33 content = {
34 type = "filesystem";
35 format = "vfat";
36 mountpoint = "/boot";
37 mountOptions = [
38 "fmask=0033" "dmask=0022"
39 ];
40 };
41 };
42 luks = {
43 size = "100%";
44 content = {
45 type = "luks";
46 name = "nvm";
47 extraFormatArgs = [
48 "--cipher" "aegis128-random"
49 "--key-size" "128"
50 "--integrity" "aead"
51 ];
52 content = {
53 type = "btrfs";
54 extraArgs = let
55 subvols = ["/persistent"] ++ map (p: "/persistent/${p}") ["/nix" "/var/log"];
56 restricted = map (p: "/persistent/${p}") ["/root"];
57 in [
58 "--csum" "blake2"
59 "--compress" "zstd:15"
60 "--rootdir" (toString (pkgs.runCommand "rootdir" {
61 } ''
62 mkdir $out
63 install -d ${lib.concatMapStringsSep " " (p: "$out/${p}") subvols}
64 install -m 0700 -d ${lib.concatMapStringsSep " " (p: "$out/${p}") restricted}
65 ''))
66 ] ++ lib.concatMap (p: ["--subvol" p]) subvols;
67 subvolumes = {
68 "/persistent".mountpoint = "/persistent";
69 "/swap" = {
70 mountpoint = "/.swap";
71 swap.swapfile.size = "96G";
72 };
73 };
74 };
75 };
76 };
77 };
78 };
79 };
80 };
81 };
82}
diff --git a/hosts/skadhi/hw.nix b/hosts/skadhi/hw.nix
index 0eb16b7a..02fb5c0e 100644
--- a/hosts/skadhi/hw.nix
+++ b/hosts/skadhi/hw.nix
@@ -16,64 +16,5 @@
16 ''; 16 '';
17 17
18 nixpkgs.system = "x86_64-linux"; 18 nixpkgs.system = "x86_64-linux";
19
20 disko.devices = {
21 disk.nvm = {
22 type = "disk";
23 device = "/dev/nvme0n1";
24 content = {
25 type = "gpt";
26 partitions = {
27 ESP = {
28 size = "512M";
29 type = "EF00";
30 content = {
31 type = "filesystem";
32 format = "vfat";
33 mountpoint = "/boot";
34 mountOptions = [
35 "fmask=0033" "dmask=0022"
36 ];
37 };
38 };
39 luks = {
40 size = "100%";
41 content = {
42 type = "luks";
43 name = "nvm";
44 extraFormatArgs = [
45 "--cipher" "aegis128-random"
46 "--key-size" "128"
47 "--integrity" "aead"
48 ];
49 content = {
50 type = "btrfs";
51 extraArgs = let
52 subvols = ["/persistent"] ++ map (p: "/persistent/${p}") ["/nix" "/var/log"];
53 restricted = map (p: "/persistent/${p}") ["/root"];
54 in [
55 "--csum" "blake2"
56 "--compress" "zstd:15"
57 "--rootdir" (toString (pkgs.runCommand "rootdir" {
58 } ''
59 mkdir $out
60 install -d ${lib.concatMapStringsSep " " (p: "$out/${p}") subvols}
61 install -m 0700 -d ${lib.concatMapStringsSep " " (p: "$out/${p}") restricted}
62 ''))
63 ] ++ lib.concatMap (p: ["--subvol" p]) subvols;
64 subvolumes = {
65 "/persistent".mountpoint = "/persistent";
66 "/swap" = {
67 mountpoint = "/.swap";
68 swap.swapfile.size = "96G";
69 };
70 };
71 };
72 };
73 };
74 };
75 };
76 };
77 };
78 }; 19 };
79} 20}
diff --git a/system-profiles/tmpfs-root.nix b/system-profiles/tmpfs-root.nix
index 23939c2e..7840dadf 100644
--- a/system-profiles/tmpfs-root.nix
+++ b/system-profiles/tmpfs-root.nix
@@ -1,14 +1,25 @@
1{ ... }: { 1{ options, lib, ... }: {
2 config = { 2 config = lib.mkMerge
3 # system.etc.overlay.enable = true; 3 [ (lib.mkIf (options ? disko) {
4 4 disko.devices.nodev = {
5 fileSystems."/" = { 5 "/" = {
6 fsType = "tmpfs"; 6 fsType = "tmpfs";
7 options = [ "mode=0755" ]; 7 mountOptions = [
8 }; 8 "mode=0755"
9 9 ];
10 security.sudo.extraConfig = '' 10 };
11 Defaults lecture = never 11 };
12 ''; 12 })
13 }; 13 (lib.mkIf (!(options ? disko)) {
14 fileSystems."/" = {
15 fsType = "tmpfs";
16 options = [ "mode=0755" ];
17 };
18 })
19 {
20 security.sudo.extraConfig = ''
21 Defaults lecture = never
22 '';
23 }
24 ];
14} 25}
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-22 20:46:52 +0000