108 lines
3.1 KiB
Nix
108 lines
3.1 KiB
Nix
{ config, lib, pkgs, modulesPath, ... }:
|
|
|
|
{
|
|
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
|
|
|
# === Boot options ===
|
|
boot.initrd.availableKernelModules =
|
|
[ "xhci_pci" "ehci_pci" "ahci" "usbhid" "uas" "usb_storage" "sd_mod" ];
|
|
boot.initrd.kernelModules = [ ];
|
|
boot.kernelModules = [ "kvm-intel" ];
|
|
boot.extraModulePackages = [ ];
|
|
|
|
# === Internal drive ===
|
|
fileSystems."/" = {
|
|
device = "zroot/safe/root";
|
|
fsType = "zfs";
|
|
};
|
|
|
|
fileSystems."/nix" = {
|
|
device = "zroot/local/nix";
|
|
fsType = "zfs";
|
|
};
|
|
|
|
fileSystems."/var/log/journal" = {
|
|
device = "zroot/safe/journal";
|
|
fsType = "zfs";
|
|
};
|
|
|
|
fileSystems."/boot" = {
|
|
device = "/dev/disk/by-uuid/8BB2-9DCB";
|
|
fsType = "vfat";
|
|
};
|
|
|
|
# === Swap ===
|
|
swapDevices =
|
|
[{ device = "/dev/disk/by-uuid/efc7e294-1c18-4dd9-aca5-f868eb9c47fc"; }];
|
|
} // (
|
|
# === External drives ===
|
|
let
|
|
cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
|
|
unlockLuksService = label: keyfile: overwrites:
|
|
lib.attrsets.recursiveUpdate {
|
|
description = "Unlock luks encrypted device '${label}'";
|
|
bindsTo = [ "dev-${label}.device" ];
|
|
after = [ "dev-${label}.device" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStart = ''
|
|
${cryptsetup} luksOpen --key-file ${keyfile} /dev/${label} ${label}opened
|
|
'';
|
|
ExecStop = ''
|
|
${cryptsetup} luksClose ${label}opened
|
|
'';
|
|
};
|
|
} overwrites;
|
|
|
|
disks = {
|
|
FRA = "8ae45289-82ed-4cf1-9d68-a0e26e5d9bb5";
|
|
BER = "85ce2e58-72fc-4a66-a376-565bb4fc39a1";
|
|
HND = "4a3765fc-155e-453d-a348-d1782447bcfe";
|
|
LEJ = "5e3c2c1e-73f6-43e6-b8f3-71c923cbeb6d";
|
|
};
|
|
in {
|
|
# Unlock all luks devices and import the zfs pools if necessary
|
|
systemd.services."luks-open-FRA" =
|
|
unlockLuksService "FRA" "/root/keys/fra" { };
|
|
systemd.services."luks-open-BER" =
|
|
unlockLuksService "BER" "/root/keys/ber" {
|
|
serviceConfig.ExecStartPost = "${pkgs.zfs}/bin/zpool import zBER";
|
|
};
|
|
systemd.services."luks-open-HND" =
|
|
unlockLuksService "HND" "/root/keys/hnd" {
|
|
serviceConfig.ExecStartPost = "${pkgs.zfs}/bin/zpool import zHND";
|
|
};
|
|
systemd.services."luks-open-LEJ" =
|
|
unlockLuksService "LEJ" "/root/keys/lej" { };
|
|
|
|
systemd.mounts = [
|
|
{
|
|
what = "/dev/mapper/FRAopened";
|
|
where = "/srv/fra";
|
|
type = "ext4";
|
|
wantedBy = [ "default.target" ];
|
|
requires = [ "luks-open-FRA.service" ];
|
|
after = [ "luks-open-FRA.service" ];
|
|
}
|
|
{
|
|
what = "/dev/mapper/vg_lej-lv_lej";
|
|
where = "/srv/lej";
|
|
type = "ext4";
|
|
wantedBy = [ "default.target" ];
|
|
requires = [ "luks-open-LEJ.service" ];
|
|
after = [ "luks-open-LEJ.service" ];
|
|
}
|
|
];
|
|
|
|
# Add udev rules for every disk
|
|
services.udev.customRules = [{
|
|
name = "85-rename-and-unlock-disks";
|
|
rules = lib.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
|
|
(alias: uuid: ''
|
|
SUBSYSTEM=="block", ENV{ID_FS_UUID}=="${uuid}", SYMLINK+="${alias}", TAG+="systemd"
|
|
'') disks);
|
|
}];
|
|
|
|
})
|