Create a gist now

Instantly share code, notes, and snippets.

What would you like to do?
Installation of NixOS with encrypted root

Installation of NixOS with encrypted root

These are my notes on instaling NixOS 16.03 on a Lenovo ThinkPad X1 Carbon (4th generation) with an encrypted root file system using UEFI.

Most of this is scrambled from the following pages:

Preparing installation media

I installed from a USB stick using the NixOS minimal ISO (this one to be precise).

$ dd bs=4M if=nixos-minimal-16.03.678.2597f52-x86_64-linux.iso of=/dev/sdb

Booting the installer

  • Disable Secure Boot Control
  • Disable USB legacy boot
  • Enable Launch CSM

Due to this kernel bug, we have to boot with the following kernel parameter: intel_pstate=no_hwp. Seems like this will be fixed soon.

Partitioning

We create a 500MB EFI boot partition (/dev/sda1) and the rest will be our LUKS encrypted physical volume for LVM (/dev/sda2).

$ gdisk /dev/sda
  • o (create new empty partition table)
  • n (add partition, 500M, type ef00 EFI)
  • n (add partition, remaining space, type 8300 Linux LVM)
  • w (write partition table and exit)

Setup the encrypted LUKS partition and open it:

$ cryptsetup luksFormat /dev/sda2
$ cryptsetup luksOpen /dev/sda2 enc-pv

We create two logical volumes, a 8GB swap parition and the rest will be our root filesystem

$ pvcreate /dev/mapper/enc-pv
$ vgcreate vg /dev/mapper/enc-pv
$ lvcreate -L 8G -n swap vg
$ lvcreate -l '100%FREE' -n root vg

Format the partitions:

$ mkfs.fat /dev/sda1
$ mkfs.ext4 -L root /dev/vg/root
$ mkswap -L swap /dev/vg/swap

Installing NixOS

We mount the partitions we just created under /mnt so we can install NixOS on them.

$ mount /dev/vg/root /mnt
$ mkdir /mnt/boot
$ mount /dev/sda1 /mnt/boot
$ swapon /dev/vg/swap

Configure WPA supplicant so we can use WIFI:

$ cat > /etc/wpa_supplicant.conf
network={
  ssid="****"
  psk="****"
}
^D
$ systemctl start wpa_supplicant

Now generate a NixOS configuration and modify it to our liking. The following is the configuration I started with.

$ nixos-generate-config --root /mnt
$ cat > /mnt/etc/nixos/configuration.nix
{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
    ];

  # https://bugzilla.kernel.org/show_bug.cgi?id=110941
  boot.kernelParams = [ "intel_pstate=no_hwp" ];

  # Supposedly better for the SSD.
  fileSystems."/".options = [ "noatime" "nodiratime" "discard" ];

  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  boot.loader.grub.version = 2;
  boot.loader.grub.device = "nodev";
  boot.loader.grub.efiSupport = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # Grub menu is painted really slowly on HiDPI, so we lower the
  # resolution. Unfortunately, scaling to 1280x720 (keeping aspect
  # ratio) doesn't seem to work, so we just pick another low one.
  boot.loader.grub.gfxmodeEfi = "1024x768";

  boot.initrd.luks.devices = [
    {
      name = "root";
      device = "/dev/disk/by-uuid/06e7d974-9549-4be1-8ef2-f013efad727e";
      preLVM = true;
      allowDiscards = true;
    }
  ];

  # Enables wireless support via wpa_supplicant.
  networking.wireless.enable = true;

  # Etcetera ...
}

If we're happy with the configuration, install NixOS and reboot.

$ nixos-install
$ reboot

Troubleshooting

If for whatever reason the system doesn't boot, we can go back to the installation environment by booting from the installation media and remounting all partitions:

$ cryptsetup luksOpen /dev/sda2 enc-pv
$ lvchange -a y /dev/vg/swap
$ lvchange -a y /dev/vg/root
$ mount /dev/vg/root /mnt
$ mount /dev/sda1 /mnt/boot
$ swapon /dev/vg/swap
$ cp /mnt/etc/wpa_supplicant.conf /etc
$ systemctl start wpa_supplicant

We can now make further modifications to the configuration and try again.

pradeepcheers commented Oct 10, 2016

Hi,
Where did you get this value from "/dev/disk/by-uuid/**06e7d974-9549-4be1-8ef2-f013efad727e**"? I'm using /dev/sda2 instead but it didn't work. I tried getting the uuid from the command ``blkid /dev/sda2`.

On nixos-install the installation is successful but on reboot the installation is saving to the boot partition. All the configuration is lost and I have to start over again with the bootable pen drive!

Any help is much appreciated. Thanks

Thanks!

jtojnar commented Jun 30, 2017

@prapradeepcheers Using the UUID returned by blkid /dev/sda2 worked for me.

jb55 commented Jul 21, 2017

boot.kernelParams = [ "intel_pstate=no_hwp" ];

wasn't needed for me on my gen5 / nixos-unstable

ahstro commented Oct 26, 2017

For who it may concern: nixos-generate-config --root /mnt generated

{
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
}

instead of the GRUB 2 related config for me, and it works fine.

Edit: Also, thanks for this gist! ❤️

MrRacoon commented Nov 3, 2017

Worked Beautifully, Thank you so much

phdoerfler commented Nov 3, 2017

The hex code for Linux LVM partitions seems to be 8e00 and not 8300.

andersk commented Dec 2, 2017

@phdoerfler Beware, using 8e00 “Linux LVM” for an LUKS-encrypted LVM partition might confuse the Debian installer into destroying your partition in certain circumstances! In the apparent absence of a dedicated LUKS code, I went for 8301 “Linux reserved”.

By the way, the EFI spec requires the EFI system partition to be FAT32, not FAT16, so you may want mkfs.fat -F 32 /dev/sda1. (Some implementations seem to allow FAT16, but not all of them.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment