These are my notes on instaling NixOS 22.11 on a Lenovo ThinkPad X1 Extreme (4th generation) with an encrypted root file system using UEFI.
Most of this is scrambled from the following pages:
- Encrypted Root on NixOS - Nix Wiki
- Installing NixOS - Chris Martin
- Linux administration and use - Earl Douglas
- Installing NixOS on a ThinkPad W540 with encrypted root - Bluish Coder
I installed from a USB stick using the NixOS minimal ISO (this one to be precise).
$ dd bs=4M if=nixos-minimal-22.11beta196.e22d9c397e5-x86_64-linux.iso of=/dev/sdb
- Disable Secure Boot Control
- Disable USB legacy boot
- Enable Launch CSM
We create a 500MB EFI boot partition (/dev/nvme0n1p1) and the rest will be our LUKS encrypted physical volume for LVM (/dev/nvme0n1p2).
$ gdisk /dev/nvme0n1
o(create new empty partition table)n(add partition, 500M, type ef00 EFI)n(add partition, remaining space, type 8300 Linux LVM)w(write partition table and exit)
Setup the encrypted LUKS partition and open it:
$ cryptsetup luksFormat /dev/nvme0n1p2
$ cryptsetup luksOpen /dev/nvme0n1p2 enc-pv
We create two logical volumes, a 8GB swap parition and the rest will be our root filesystem
$ pvcreate /dev/mapper/enc-pv
$ vgcreate vg /dev/mapper/enc-pv
$ lvcreate -L 8G -n swap vg
$ lvcreate -l '100%FREE' -n root vg
Format the partitions:
$ mkfs.fat /dev/nvme0n1p1
$ mkfs.ext4 -L root /dev/vg/root
$ mkswap -L swap /dev/vg/swap
We mount the partitions we just created under /mnt so we can install NixOS on them.
$ mount /dev/vg/root /mnt
$ mkdir /mnt/boot
$ mount /dev/nvme0n1p1 /mnt/boot
$ swapon /dev/vg/swap
Configure WPA supplicant so we can use WIFI:
# wpa_cli -i wlan0
wpa_cli v2.9
[...]
Interactive mode
> add_network
0
> set_network 0 ssid "your_ssid"
> set_network 0 psk "your_pass"
> enable_network 0
OK
<3>SME: Trying to authenticate with 12:34:56:78:9a:bc (SSID='Guest' freq=2437 MHz)
<3>Trying to associate with 12:34:56:78:9a:bc (SSID='Guest' freq=2437 MHz)
<3>Associated with 12:34:56:78:9a:bc
<3>CTRL-EVENT-CONNECTED - Connection to 12:34:56:78:9a:bc completed [id=0 id_str=]
<3>CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
[...]Now generate a NixOS configuration and modify it to our liking. The following is the configuration I started with.
# backup generated UUID disks
mv /mnt/etc/nixos/hardware-configuration.nix /tmp
# clone our configs
rm -rf /mnt/etc/nixos
git clone https://gitlab.com/klden/nixos-conf.git /mnt/etc/nixos
# use generated configs by nixos-generate-config
cat /tmp/hardware-configuration.nix >> /mnt/etc/nixos/hosts/<YOUR_HOST>.nix
# update duplicate configs accordingly if necessary
vim /mnt/etc/nixos/hosts/<YOUR_HOST>.nix
If we're happy with the configuration, install NixOS and reboot.
$ nixos-install --impure --flake /mnt/flake#<YOUR_HOST>
$ reboot
If for whatever reason the system doesn't boot, we can go back to the installation environment by booting from the installation media and remounting all partitions:
$ cryptsetup luksOpen /dev/nvme0n1p2 enc-pv
$ lvchange -a y /dev/vg/swap
$ lvchange -a y /dev/vg/root
$ mount /dev/vg/root /mnt
$ mount /dev/nvme0n1p1 /mnt/boot
$ swapon /dev/vg/swap
$ wpa_cli ...
$ systemctl start wpa_supplicant
We can now make further modifications to the configuration and try again.