back to btrfs

common.nix

@@ -457,8 +457,8 @@ in
     # init password
     hashedPassword = builtins.readFile "/data/nixos/password.secret";
 
-    # use same keys as my main user
+    # use fixed auth keys
-    openssh.authorizedKeys.keys = pkgs.lib.splitString "\n" (builtins.readFile "/home/cullmann/.ssh/authorized_keys");
+    openssh.authorizedKeys.keys = pkgs.lib.splitString "\n" (builtins.readFile "/data/nixos/authorized_keys.secret");
   };
 
   home-manager.users.root = {
@@ -488,6 +488,9 @@ in
 
     # init password
     hashedPassword = builtins.readFile "/data/nixos/password.secret";
+
+    # use fixed auth keys
+    openssh.authorizedKeys.keys = pkgs.lib.splitString "\n" (builtins.readFile "/data/nixos/authorized_keys.secret");
   };
 
   home-manager.users.cullmann = {

mini/install.txt

@@ -21,6 +21,13 @@ nix --extra-experimental-features flakes --extra-experimental-features nix-comma
 
 sudo dd if=result/iso/nixos-24.05.20240108.317484b-x86_64-linux.iso of=/dev/sda bs=4M conv=fsync
 
+#
+# enable ssh for root
+#
+
+sudo bash
+passwd
+
 #
 # kill old efi boot stuff
 #
@@ -37,10 +44,6 @@ efibootmgr
 # install script below
 #
 
-# fix unlocking https://nixos.wiki/wiki/Bcachefs
-nix-env -iA nixos.keyutils
-keyctl link @u @s
-
 # Defining some helper variables (these will be used in later code
 # blocks as well, so make sure to use the same terminal session or
 # redefine them later)
@@ -62,8 +65,7 @@ gdisk -l $DISK
 # create partitions
 parted $DISK -- mklabel gpt
 sgdisk -n 1:0:+1024M -c 1:"EFI System Partition" -t 1:EF00 $DISK
-sgdisk -n 2:0:+256G -c 2:"nix" -t 2:8e00 $DISK
+sgdisk -n 2:0:0 -c 2:"Linux" -t 2:8e00 $DISK
-sgdisk -n 3:0:0 -c 3:"data" -t 3:8e00 $DISK
 parted $DISK -- set 1 boot on
 
 sleep 5
@@ -74,12 +76,37 @@ cat /proc/partitions
 # boot partition
 mkfs.fat -F 32 -n EFIBOOT $DISK-part1
 
-# create encrypted bcachefs
+# create the crypto containers
-bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=nix --discard -f $DISK-part2
+cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase $DISK-part2
-bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=data --discard -f $DISK-part3
+
+sleep 5
+
+# open them, set right options persistently
+cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DISK-part2 crypt-system
+
+sleep 5
+lsblk --fs
+
+# create btrfs with fast & strong checksumming and fast mounting
+mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-system
+
+sleep 5
+btrfs filesystem show
+
+# create all the volumes
+mount /dev/mapper/crypt-system /mnt
+btrfs subvolume create /mnt/data
+btrfs subvolume create /mnt/nix
+btrfs subvolume create /mnt/root
+
+sleep 5
+btrfs subvolume list /mnt
+
+# umount again, we will only use explicit subvolumes
+umount /mnt
 
 # prepare install
-mount -t tmpfs none /mnt
+mount -o subvol=root,noatime,nodiratime /dev/mapper/crypt-system /mnt
 
 # Create directories to mount file systems on
 mkdir -p /mnt/{data,nix,home,boot,root,etc/nixos}
@@ -87,9 +114,9 @@ mkdir -p /mnt/{data,nix,home,boot,root,etc/nixos}
 # mount the ESP
 mount $DISK-part1 /mnt/boot
 
-# mount bcachefs stuff
+# mount volumes
-mount -o noatime,nodiratime $DISK-part2 /mnt/nix
+mount -o subvol=data,noatime,nodiratime /dev/mapper/crypt-system /mnt/data
-mount -o noatime,nodiratime $DISK-part3 /mnt/data
+mount -o subvol=nix,noatime,nodiratime /dev/mapper/crypt-system /mnt/nix
 
 # bind mount persistent stuff to data
 mkdir -p /mnt/{data/home,data/root,data/nixos/$HOST}
@@ -121,6 +148,7 @@ nixos-install --no-root-passwd --root /mnt
 # unmount all stuff
 
 umount -Rl /mnt
+cryptsetup luksClose crypt-system
 
 # sync all /data after the install
 
@@ -139,5 +167,19 @@ wipefs -a $DD
 
 sleep 5
 
-# create encrypted bcachefs
+# create the crypto containers
-bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=vms --discard -f $DD
+cryptsetup luksFormat --batch-mode --verify-passphrase $DD
+
+sleep 5
+
+# open them, set right options persistently
+cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DD crypt-vms
+
+sleep 5
+lsblk --fs
+
+# create btrfs with fast & strong checksumming and fast mounting
+mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-vms
+
+sleep 5
+btrfs filesystem show