mini zfs

mini/hardware-configuration.nix

@@ -15,16 +15,9 @@
 
   # /boot efi partition to boot in UEFI mode
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/1B9E-991C";
+    device = "/dev/disk/by-id/nvme-CT4000P3PSSD8_2325E6E63746-part1";
     fsType = "vfat";
     options = [ "fmask=0022" "dmask=0022" ];
     neededForBoot = true;
   };
-
-  # encrypted system
-  boot.initrd.luks.devices."crypt-system" = {
-    device = "/dev/disk/by-uuid/565695e2-a09b-412b-9f26-4da10402b967";
-    allowDiscards = true;
-    bypassWorkqueues = true;
-  };
 }

mini/install.txt

@@ -47,56 +47,73 @@ for D in $DISK $DISK2; do
     sgdisk -n 1:0:+1024M -c 1:"EFI System Partition" -t 1:EF00 $D
     sgdisk -n 2:0:0 -c 2:"Linux" -t 2:8e00 $D
     parted $D -- set 1 boot on
-    sleep 5
 
     # boot partition
     mkfs.fat -F 32 -n EFIBOOT $D-part1
-    sleep 5
 done
 
+
 # take a look at the partitions
 lsblk
 
-# create the RAID-0, second partitions on all disks
+# ZFS zpool creation with compression and encryption
-mdadm --create --verbose --level=0 --raid-devices=2 /dev/md/system $DISK-part2 $DISK2-part2
+zpool create \
+    -o ashift=13 \
+    -o autotrim=off \
+    -O acltype=posixacl \
+    -O atime=off \
+    -O canmount=off \
+    -O compression=on \
+    -O dnodesize=auto \
+    -O utf8only=on \
+    -O normalization=formD \
+    -O xattr=sa \
+    -O mountpoint=none \
+    -O encryption=on \
+    -O keylocation=prompt \
+    -O keyformat=passphrase \
+    zpool $DISK-part2 $DISK2-part2
+
 sleep 5
 
 # take a look at the partitions
 lsblk
 
-# create the LUKS container and open it
+# show the pool
-cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase /dev/md/system
+zpool status
-cryptsetup luksOpen /dev/md/system crypt-system
+
 sleep 5
 
-# take a look at the partitions
+# create all the volumes
-lsblk
+zfs create -o mountpoint=legacy zpool/data
+zfs create -o mountpoint=legacy zpool/nix
+zfs create -o mountpoint=legacy zpool/root
 
-# create btrfs with volumes
-mkfs.btrfs -f --features block-group-tree --label system /dev/mapper/crypt-system
-mount -t btrfs /dev/mapper/crypt-system /mnt
-btrfs subvolume create /mnt/data
-btrfs subvolume create /mnt/nix
-btrfs subvolume create /mnt/tmp
-umount /mnt
 sleep 5
 
-# take a look at the partitions
+# show the pool
-lsblk
+zpool status
 
-# prepare install, tmpfs root
+sleep 5
-mount -t tmpfs none /mnt
+
+# create ZFS snapshot that we'll rollback to on boot
+# see https://ryanseipp.com/post/nixos-encrypted-root/
+zfs snapshot zpool/root@blank
+
+sleep 5
+
+# prepare install, root
+mount -t zfs zpool/root /mnt
 
 # Create directories to mount file systems on
-mkdir -p /mnt/{data,nix,boot,root,etc/nixos,tmp}
+mkdir -p /mnt/{data,nix,boot,root,etc/nixos}
 
 # mount the ESP
 mount $DISK-part1 /mnt/boot
 
 # mount volumes
-mount -o subvol=data,noatime /dev/mapper/crypt-system /mnt/data
+mount -t zfs zpool/data /mnt/data
-mount -o subvol=nix,noatime /dev/mapper/crypt-system /mnt/nix
+mount -t zfs zpool/nix /mnt/nix
-mount -o subvol=tmp,noatime /dev/mapper/crypt-system /mnt/tmp
 
 # bind mount persistent stuff to data
 mkdir -p /mnt/data/{root,nixos/$HOST}
@@ -126,8 +143,7 @@ nixos-install --option experimental-features 'nix-command flakes' --no-root-pass
 # unmount all stuff and sync
 
 umount -Rl /data /mnt
-cryptsetup luksClose crypt-system
+zpool export -a
-mdadm --stop /dev/md/system
 sync
 
 # shutdown once