From f09551f8ecb6e7ad49a1a2110ff4ce7aee0b3c3e Mon Sep 17 00:00:00 2001
From: Christoph Cullmann <christoph@cullmann.io>
Date: Mon, 21 Apr 2025 19:30:33 +0200
Subject: [PATCH] adjust miku to zfs

---
 miku/configuration.nix          |  3 --
 miku/hardware-configuration.nix |  9 +----
 miku/install.txt                | 68 ++++++++++++++++++++-------------
 3 files changed, 43 insertions(+), 37 deletions(-)

diff --git a/miku/configuration.nix b/miku/configuration.nix
index 06ac46f..aa5c49d 100644
--- a/miku/configuration.nix
+++ b/miku/configuration.nix
@@ -13,10 +13,7 @@
       # Shared config of all machines
       /data/nixos/share/common.nix
     ];
-cchchchc
-chchchchc
 
-SSSSS
   # our hostname and an ID for ZFS
   networking.hostName = "miku";
   networking.hostId = "c132caed";
diff --git a/miku/hardware-configuration.nix b/miku/hardware-configuration.nix
index f7a38c5..0d8c15a 100644
--- a/miku/hardware-configuration.nix
+++ b/miku/hardware-configuration.nix
@@ -15,16 +15,9 @@
 
   # /boot efi partition to boot in UEFI mode
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/5B5C-07AD";
+    device = "/dev/disk/by-id/nvme-KINGSTON_SFYRD4000G_50026B7686EC5F33-part1";
     fsType = "vfat";
     options = [ "fmask=0022" "dmask=0022" ];
     neededForBoot = true;
   };
-
-  # encrypted system
-  boot.initrd.luks.devices."crypt-system" = {
-    device = "/dev/disk/by-uuid/38f19fd3-61b4-4a34-a5b8-0059eeff3c8e";
-    allowDiscards = true;
-    bypassWorkqueues = true;
-  };
 }
diff --git a/miku/install.txt b/miku/install.txt
index d7c9c0e..5ee0698 100644
--- a/miku/install.txt
+++ b/miku/install.txt
@@ -52,56 +52,73 @@ for D in $DISK $DISK2; do
     sgdisk -n 1:0:+1024M -c 1:"EFI System Partition" -t 1:EF00 $D
     sgdisk -n 2:0:0 -c 2:"Linux" -t 2:8e00 $D
     parted $D -- set 1 boot on
-    sleep 5
 
     # boot partition
     mkfs.fat -F 32 -n EFIBOOT $D-part1
-    sleep 5
 done
 
+
 # take a look at the partitions
 lsblk
 
-# create the RAID-0, second partitions on all disks
-mdadm --create --verbose --level=0 --raid-devices=2 /dev/md/system $DISK-part2 $DISK2-part2
+# ZFS zpool creation with compression and encryption
+zpool create \
+    -o ashift=13 \
+    -o autotrim=off \
+    -O acltype=posixacl \
+    -O atime=off \
+    -O canmount=off \
+    -O compression=on \
+    -O dnodesize=auto \
+    -O utf8only=on \
+    -O normalization=formD \
+    -O xattr=sa \
+    -O mountpoint=none \
+    -O encryption=on \
+    -O keylocation=prompt \
+    -O keyformat=passphrase \
+    zpool $DISK-part2 $DISK2-part2
+
 sleep 5
 
 # take a look at the partitions
 lsblk
 
-# create the LUKS container and open it
-cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase /dev/md/system
-cryptsetup luksOpen /dev/md/system crypt-system
+# show the pool
+zpool status
+
 sleep 5
 
-# take a look at the partitions
-lsblk
+# create all the volumes
+zfs create -o mountpoint=legacy zpool/data
+zfs create -o mountpoint=legacy zpool/nix
+zfs create -o mountpoint=legacy zpool/root
 
-# create btrfs with volumes
-mkfs.btrfs -f --features block-group-tree --label system /dev/mapper/crypt-system
-mount -t btrfs /dev/mapper/crypt-system /mnt
-btrfs subvolume create /mnt/data
-btrfs subvolume create /mnt/nix
-btrfs subvolume create /mnt/tmp
-umount /mnt
 sleep 5
 
-# take a look at the partitions
-lsblk
+# show the pool
+zpool status
 
-# prepare install, tmpfs root
-mount -t tmpfs none /mnt
+sleep 5
+
+# create ZFS snapshot that we'll rollback to on boot
+# see https://ryanseipp.com/post/nixos-encrypted-root/
+zfs snapshot zpool/root@blank
+
+sleep 5
+
+# prepare install, root
+mount -t zfs zpool/root /mnt
 
 # Create directories to mount file systems on
-mkdir -p /mnt/{data,nix,boot,root,etc/nixos,tmp}
+mkdir -p /mnt/{data,nix,boot,root,etc/nixos}
 
 # mount the ESP
 mount $DISK-part1 /mnt/boot
 
 # mount volumes
-mount -o subvol=data,noatime /dev/mapper/crypt-system /mnt/data
-mount -o subvol=nix,noatime /dev/mapper/crypt-system /mnt/nix
-mount -o subvol=tmp,noatime /dev/mapper/crypt-system /mnt/tmp
+mount -t zfs zpool/data /mnt/data
+mount -t zfs zpool/nix /mnt/nix
 
 # bind mount persistent stuff to data
 mkdir -p /mnt/data/{root,nixos/$HOST}
@@ -131,8 +148,7 @@ nixos-install --option experimental-features 'nix-command flakes' --no-root-pass
 # unmount all stuff and sync
 
 umount -Rl /data /mnt
-cryptsetup luksClose crypt-system
-mdadm --stop /dev/md/system
+zpool export -a
 sync
 
 # shutdown once