cullmann/nixos
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

prepare for zfs

Browse source
This commit is contained in:
Christoph Cullmann 2024-10-03 00:50:52 +02:00
parent 3ed8d71a5f
commit d5e6a93db3
No known key found for this signature in database
10 changed files with 75 additions and 119 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
beta/configuration.nix
View file

@ -11,7 +11,7 @@
./hardware-configuration.nix
# Shared config of all machines
/nix/data/nixos/share/common.nix
/data/nixos/share/common.nix
];
# our hostname and an ID for ZFS

12
beta/hardware-configuration.nix
View file

@ -18,18 +18,6 @@
neededForBoot = true;
};
# /nix encrypted btrfs for the remaining space
boot.initrd.luks.devices."crypt0" = {
device = "/dev/disk/by-id/nvme-SAMSUNG_MZVLB1T0HBLR-000L2_S4DZNX0R362286-part2";
allowDiscards = true;
bypassWorkqueues = true;
};
fileSystems."/nix" =
{ device = "/dev/mapper/crypt0";
fsType = "btrfs";
neededForBoot = true;
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

2
mini/configuration.nix
View file

@ -11,7 +11,7 @@
./hardware-configuration.nix
# Shared config of all machines
/nix/data/nixos/share/common.nix
/data/nixos/share/common.nix
];
# our hostname and an ID for ZFS

18
mini/hardware-configuration.nix
View file

@ -18,24 +18,6 @@
neededForBoot = true;
};
# /nix encrypted btrfs for the remaining space
boot.initrd.luks.devices."crypt0" = {
device = "/dev/disk/by-id/nvme-CT4000P3PSSD8_2325E6E63746-part2";
allowDiscards = true;
bypassWorkqueues = true;
};
boot.initrd.luks.devices."crypt1" = {
device = "/dev/disk/by-id/ata-CT2000MX500SSD1_2138E5D5061F";
allowDiscards = true;
bypassWorkqueues = true;
};
fileSystems."/nix" =
{ device = "/dev/mapper/crypt0";
fsType = "btrfs";
options = [ "device=/dev/mapper/crypt1" ];
neededForBoot = true;
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

2
neko/configuration.nix
View file

@ -11,7 +11,7 @@
./hardware-configuration.nix
# Shared config of all machines
/nix/data/nixos/share/common.nix
/data/nixos/share/common.nix
];
# our hostname and an ID for ZFS

23
neko/hardware-configuration.nix
View file

@ -18,29 +18,6 @@
neededForBoot = true;
};
# /nix encrypted btrfs for the remaining space
boot.initrd.luks.devices."crypt0" = {
device = "/dev/disk/by-id/nvme-Seagate_FireCuda_530_ZP4000GM30013_7VS01VBM-part2";
allowDiscards = true;
bypassWorkqueues = true;
};
boot.initrd.luks.devices."crypt1" = {
device = "/dev/disk/by-id/nvme-CT2000P5PSSD8_213330E4ED05";
allowDiscards = true;
bypassWorkqueues = true;
};
boot.initrd.luks.devices."crypt2" = {
device = "/dev/disk/by-id/nvme-Samsung_SSD_980_PRO_2TB_S69ENF0R846614L";
allowDiscards = true;
bypassWorkqueues = true;
};
fileSystems."/nix" =
{ device = "/dev/mapper/crypt0";
fsType = "btrfs";
options = [ "device=/dev/mapper/crypt1" "device=/dev/mapper/crypt2" ];
neededForBoot = true;
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

70
neko/install.txt
View file

@ -70,18 +70,31 @@ mkfs.fat -F 32 -n EFIBOOT $DISK-part1
sleep 5
# create the crypto containers with proper 4k sectors
cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase $DISK-part2
cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase $DISK2
cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase $DISK3
# ZFS zpool creation with encryption
zpool create \
-o ashift=13 \
-o recordsize=64K \
-o autotrim=off \
-O acltype=posixacl \
-O atime=off \
-O canmount=off \
-O compression=on \
-O dnodesize=auto \
-O utf8only=on \
-O normalization=formD \
-O xattr=sa \
-O mountpoint=none \
-O encryption=on \
-O keylocation=prompt \
-O keyformat=passphrase \
zpool $DISK-part2 $DISK2 $DISK3
# open the containers
cryptsetup luksOpen $DISK-part2 crypt0
cryptsetup luksOpen $DISK2 crypt1
cryptsetup luksOpen $DISK3 crypt2
sleep 5
# create one large btrfs on them, RAID0 with strong checksum
mkfs.btrfs -f -d raid0 -m raid0 --checksum blake2 --features block-group-tree --label nix /dev/mapper/crypt0 /dev/mapper/crypt1 /dev/mapper/crypt2
# create all the volumes
zfs create -o mountpoint=legacy zpool/data
zfs create -o mountpoint=legacy zpool/nix
zfs create -o mountpoint=legacy zpool/tmp
sleep 5
@ -89,27 +102,25 @@ sleep 5
mount -t tmpfs none /mnt
# Create directories to mount file systems on
mkdir -p /mnt/{nix,home,boot,root,etc/nixos}
mkdir -p /mnt/{data,nix,home,boot,root,etc/nixos,tmp}
# mount the ESP
mount $DISK-part1 /mnt/boot
# mount large btrfs
mount -t btrfs /dev/mapper/crypt0 -o device=/dev/mapper/crypt1 -o device=/dev/mapper/crypt2 /mnt/nix
# ensure tmp fills not the RAM
mkdir -p /mnt/tmp /mnt/nix/tmp
mount --bind /mnt/nix/tmp /mnt/tmp
# mount volumes
mount -t zfs zpool/data /mnt/data
mount -t zfs zpool/nix /mnt/nix
mount -t zfs zpool/tmp /mnt/tmp
# bind mount persistent stuff to data
mkdir -p /mnt/nix/data/{home,root,nixos/$HOST}
mount --bind /mnt/nix/data/home /mnt/home
mount --bind /mnt/nix/data/root /mnt/root
mount --bind /mnt/nix/data/nixos/$HOST /mnt/etc/nixos
mkdir -p /mnt/data/{home,root,nixos/$HOST}
mount --bind /mnt/data/home /mnt/home
mount --bind /mnt/data/root /mnt/root
mount --bind /mnt/data/nixos/$HOST /mnt/etc/nixos
# create fake /nix/data to have the right paths
mkdir -p /nix/data
mount --bind /mnt/nix/data /nix/data
# create fake /data to have the right paths
mkdir -p /data
mount --bind /mnt/data /data
# take a look
mount
@ -121,7 +132,7 @@ nixos-generate-config --root /mnt
# copy config data from another machine including secrets
sudo scp -r /nix/data/nixos root@192.168.13.171:/mnt/nix/data
sudo scp -r /data/nixos root@192.168.13.171:/mnt/data
# install
@ -129,11 +140,8 @@ nixos-install --option experimental-features 'nix-command flakes' --no-root-pass
# unmount all stuff and sync
umount -Rl /nix/data /mnt
cryptsetup luksClose crypt0
cryptsetup luksClose crypt1
cryptsetup luksClose crypt2
sync
umount -Rl /data /mnt
zpool export -a
# shutdown once
@ -141,4 +149,4 @@ shutdown -h now
# sync all /data after the install
sudo -E rsync -va --delete --one-file-system /nix/data/ root@192.168.13.171:/nix/data/
sudo -E rsync -va --delete --one-file-system /data/ root@192.168.13.171:/data/

2
packages/cullmann-fonts.nix
View file

@ -5,7 +5,7 @@
stdenvNoCC.mkDerivation {
pname = "cullmann-fonts";
version = "1.0";
src = /nix/data/nixos/secret/fonts;
src = /data/nixos/secret/fonts;
installPhase = ''
mkdir -p $out/share/fonts/truetype/

59
share/common.nix
View file

@ -1,7 +1,7 @@
{ config, pkgs, ... }:
let
impermanence = builtins.fetchTarball "https://github.com/nix-community/impermanence/archive/master.tar.gz";
cullmann-fonts = pkgs.callPackage "/nix/data/nixos/packages/cullmann-fonts.nix" {};
cullmann-fonts = pkgs.callPackage "/data/nixos/packages/cullmann-fonts.nix" {};
in
{
#
@ -14,7 +14,7 @@ in
"${impermanence}/nixos.nix"
# our users
"/nix/data/nixos/share/users.nix"
"/data/nixos/share/users.nix"
];
# This value determines the NixOS release from which the default
@ -25,8 +25,9 @@ in
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.05"; # Did you read the comment?
# use the latest kernel
boot.kernelPackages = pkgs.linuxPackages_latest;
# use the latest kernel with ZFS support and enable that file system
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
boot.supportedFilesystems = [ "zfs" ];
# my kernel parameters
boot.kernelParams = [
@ -64,40 +65,52 @@ in
options = [ "defaults" "size=8G" "mode=755" ];
};
# tmp on /nix to not fill RAM
fileSystems."/tmp" =
{ device = "/nix/tmp";
fsType = "none";
# my data
fileSystems."/data" =
{ device = "zpool/data";
fsType = "zfs";
neededForBoot = true;
};
# the system
fileSystems."/nix" =
{ device = "zpool/nix";
fsType = "zfs";
neededForBoot = true;
};
# tmp to not fill RAM
fileSystems."/tmp" =
{ device = "zpool/tmp";
fsType = "zfs";
neededForBoot = true;
options = [ "bind" ];
depends = [ "/nix" ];
};
# bind mount to have user homes
fileSystems."/home" =
{ device = "/nix/data/home";
{ device = "/data/home";
fsType = "none";
neededForBoot = true;
options = [ "bind" ];
depends = [ "/nix" ];
depends = [ "/data" ];
};
# bind mount to have root home
fileSystems."/root" =
{ device = "/nix/data/root";
{ device = "/data/root";
fsType = "none";
neededForBoot = true;
options = [ "bind" ];
depends = [ "/nix" ];
depends = [ "/data" ];
};
# bind mount to have NixOS configuration, different per host
fileSystems."/etc/nixos" =
{ device = "/nix/data/nixos/${config.networking.hostName}";
{ device = "/data/nixos/${config.networking.hostName}";
fsType = "none";
neededForBoot = true;
options = [ "bind" ];
depends = [ "/nix" ];
depends = [ "/data" ];
};
# keep some stuff persistent
@ -228,18 +241,6 @@ in
'';
};
# trim the disks weekly
services.fstrim = {
enable = true;
interval = "weekly";
};
# scrub the disks weekly
services.btrfs.autoScrub = {
enable = true;
interval = "weekly";
};
# avoid suspend ever to be triggered
systemd.targets.sleep.enable = false;
systemd.targets.suspend.enable = false;
@ -485,7 +486,7 @@ in
mode = "0400";
};
environment.etc."mail/secrets" = {
text = builtins.readFile "/nix/data/nixos/secret/mail.secret";
text = builtins.readFile "/data/nixos/secret/mail.secret";
mode = "0400";
};

4
share/users.nix
View file

@ -23,10 +23,10 @@ in
users.root = {
# init password
hashedPassword = builtins.readFile "/nix/data/nixos/secret/password.secret";
hashedPassword = builtins.readFile "/data/nixos/secret/password.secret";
# use fixed auth keys
openssh.authorizedKeys.keys = pkgs.lib.splitString "\n" (builtins.readFile "/nix/data/nixos/secret/authorized_keys.secret");
openssh.authorizedKeys.keys = pkgs.lib.splitString "\n" (builtins.readFile "/data/nixos/secret/authorized_keys.secret");
};
#