Encrypted ZFS for NixOS

encrypted-zfs-nixos.org

Encrypted ZFS for NixOS

Assumptions

We will have add one partition to a zpool.

You have the following set to appropriate values:

• disk: the path for your disk device, e.g. /dev/sdb or /dev/nvme0
• efi: the path for the EFI boot partition’s device, e.g. /dev/sdb1
• part: the path to the partition of your root filesystem, e.g. /dev/sdb2

Setup your partitions

First you will need to setup your partitions:

gdisk ${disk}

In my case I needed to ensure my EFI boot partition had the right type and I added a Linux partition:

• /dev/sdb1 - EFI boot partition
• /dev/sdb2 - Linux filesystem (referrd to as part from here on or interpolated using ${part})

Setup disk encryption

Using LUKS we will setup our block-level encryption:

cryptsetup luksFormat ${part}
cryptsetup luksOpen ${part} nixos

Create the ZFS pool

Find the UUID for the partition’s device:

declare uuid="$(lsblk -lno UUID ${part})"

Now create the ZFS pool:

zpool create \
      -o ashift=12 \
      -O mountpoint=none \
      zroot /dev/disk/by-uuid/${uuid}

zfs create zroot/root -o mountpoint=legacy

NixOS installer mounts

After you boot into the NixOS installer:

mount -t zfs zroot/root /mnt
mkdir /mnt/boot
mount ${efi} /mnt/boot

In case you need to remind yourself of the key you used to encrypt via LUKS at the block level:

dmsetup table --showkey nixos

Install NixOS

First generate the generic installer configs for your NixOS installation:

nixos-generate-config --root /mnt

TODO: add basic configuration.nix to download during installer.

zpool create \
      -o ashift=12 \
      -O mountpoint=none \
      zroot /dev/disk/by-uuid/${uuid}

shouldn't that be: /dev/mapper/nixos ?