Skip to content

Instantly share code, notes, and snippets.

@dysinger
Last active December 28, 2022 18:39
Show Gist options
  • Save dysinger/2a768db5b6e3b729ec898d7d4208add3 to your computer and use it in GitHub Desktop.
Save dysinger/2a768db5b6e3b729ec898d7d4208add3 to your computer and use it in GitHub Desktop.
Basic Full-Disk Encrypted ZFS Thinkpad (w/ 512 sector SSD) booted from USB key
# Basic Full-Disk Encrypted ZFS Thinkpad (w/ 512 sector SSD) booted from USB key
# EFI/BOOT:
# export BOOT=/dev/disk/by-id/usb-SanDisk_Ultra_Fit_4C530001011030101042-0\:0
# parted --script $BOOT -- \
# mklabel gpt \
# mkpart esp fat32 1MiB 512MiB \
# mkpart primary 512MiB 100% \
# set 1 boot on
# mkfs.vfat -n BOOT $BOOT-part1
# ZFS:
# export ROOT=/dev/disk/by-id/nvme-WDC_PC_SN730_SDBQNTY-1T00-1001_2018JE446304
# zpool create -f \
# -o ashift=9 \
# -O compression=on \
# -O encryption=on \
# -O keyformat=passphrase \
# -O mountpoint=none \
# laptop \
# $ROOT
# zfs create -o refreservation=1G -o mountpoint=none laptop/reserved
# zfs create -o mountpoint=none laptop/local
# zfs create -o mountpoint=legacy laptop/local/nix
# zfs create -o mountpoint=none laptop/system
# zfs create -o mountpoint=legacy laptop/system/root
# zfs create -o mountpoint=legacy -o xattr=sa -o acltype=posixacl laptop/system/var
# zfs create -o mountpoint=none laptop/user
# zfs create -o mountpoint=legacy laptop/user/home
# zfs set com.sun:auto-snapshot=true laptop/user
# INSTALL:
# mount -t zfs laptop/system/root /mnt
# mkdir /mnt/{nix,var,home,boot}
# mount -t zfs laptop/local/nix /mnt/nix
# mount -t zfs laptop/system/var /mnt/var
# mount -t zfs laptop/user/home /mnt/home
# mount -t vfat $BOOT-part1 /mnt/boot
# nixos-generate-config --root /mnt
{ config, pkgs, ... }:
let
privateZeroTierInterfaces = [
"ztr2qxf557" # vpn
];
in
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
# NIX / NIXOS
nix.autoOptimiseStore = true;
nixpkgs.config.allowUnfree = true;
nixpkgs.config.pulseaudio = true;
system.stateVersion = "20.09";
# BOOT
boot.kernelParams = [ "consoleblank=90" ];
boot.loader.efi.canTouchEfiVariables = true;
boot.loader.systemd-boot.enable = true;
# ZFS
boot.initrd.supportedFilesystems = [ "zfs" ];
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.enableUnstable = true;
services.zfs.autoScrub.enable = true;
services.zfs.autoSnapshot.enable = true;
services.zfs.autoSnapshot.frequent = 8;
services.zfs.autoSnapshot.monthly = 1;
services.zfs.trim.enable = true;
# HARDWARE
hardware.bluetooth.enable = true;
hardware.cpu.intel.updateMicrocode = true;
hardware.opengl.driSupport = true;
hardware.opengl.driSupport32Bit = true;
hardware.opengl.enable = true;
hardware.pulseaudio.enable = true;
hardware.pulseaudio.extraModules = [ pkgs.pulseaudio-modules-bt ];
hardware.pulseaudio.support32Bit = true;
hardware.pulseaudio.zeroconf.discovery.enable = true;
hardware.pulseaudio.zeroconf.publish.enable = true;
hardware.sane.enable = true;
hardware.video.hidpi.enable = true;
sound.enable = true;
# NETWORKING
networking.firewall.enable = false;
networking.firewall.trustedInterfaces = privateZeroTierInterfaces;
networking.hostId = "a751b2ef"; # cut -c-8 </proc/sys/kernel/random/uuid
networking.hostName = "mahlaptop";
networking.nameservers = [
"2606:4700:4700::1111" # CloudFlare
"8.8.8.8" # Google
];
networking.networkmanager.enable = true;
networking.networkmanager.wifi.powersave = true;
# mDNS
services.avahi.enable = true;
services.avahi.interfaces = privateZeroTierInterfaces;
services.avahi.nssmdns = true;
services.avahi.publish.addresses = true;
services.avahi.publish.domain = true;
services.avahi.publish.enable = true;
services.avahi.publish.userServices = true;
services.avahi.publish.workstation = true;
# LOCALE
i18n.defaultLocale = "en_US.UTF-8";
time.timeZone = "America/Los_Angeles";
# INPUT
console.useXkbConfig = true;
services.xserver.layout = "us";
services.xserver.libinput.disableWhileTyping = true;
services.xserver.libinput.enable = true;
services.xserver.libinput.naturalScrolling = true;
services.xserver.synaptics.twoFingerScroll = true;
services.xserver.xkbOptions = "ctrl:nocaps,compose:ralt";
services.xserver.xkbVariant = "dvorak";
# GPG
programs.gnupg.agent.enable = true;
# SSH
services.openssh.enable = true;
services.openssh.openFirewall = false;
# ANDROID
programs.adb.enable = true;
# KEYBASE
services.kbfs.enable = true;
# ZEROTIER
services.zerotierone.enable = true;
services.zerotierone.joinNetworks = [
"8056c2e21c000001" # earth.zerotier.net (PUBLIC)
"565799e8f6da2f47" # vpn (PRIVATE)
];
# VM
virtualisation.docker.autoPrune.enable = true;
virtualisation.docker.enable = true;
virtualisation.docker.storageDriver = "zfs";
virtualisation.libvirtd.enable = true;
# USERS
users.extraUsers.me.description = "Computer User";
users.extraUsers.me.isNormalUser = true;
users.extraUsers.me.extraGroups = [
"adbusers"
"audio"
"dialout"
"docker"
"kvm"
"libvirtd"
"lp"
"networkmanager"
"power"
"scanner"
"video"
"wheel"
];
users.extraUsers.me.openssh.authorizedKeys.keys = [
"ssh-rsa ...."
];
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment