Add disko with LUKS encryption and impermanence setup

flake.lock

@@ -214,6 +214,26 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
@@ -990,6 +1010,7 @@
         "awesome-wallpapers": "awesome-wallpapers",
         "blog": "blog",
         "default-creds": "default-creds",
+        "disko": "disko",
         "git-hooks": "git-hooks",
         "helium-browser": "helium-browser",
         "home-manager": "home-manager",

flake.nix

@@ -36,6 +36,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     impermanence.url = "github:nix-community/impermanence";
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     notashelf-tuigreet = {
       url = "github:NotAShelf/tuigreet";
       inputs.nixpkgs.follows = "nixpkgs";

hosts/laptop/configuration.nix

@@ -19,6 +19,7 @@
     ./wireguard.nix
     ./persistence.nix # impermanence: what to keep once "/" is wiped on boot
     ./usbguard.nix
+    ./disko.nix
     ./secrets
 
     # You should let those lines as is

hosts/laptop/disko.nix

@@ -0,0 +1,56 @@
+{
+  disko.devices = {
+    nodev = {
+      "/" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "defaults"
+          "size=12G"
+          "mode=755"
+        ];
+      };
+    };
+
+    disk = {
+      boot = {
+        type = "disk";
+        device = "/dev/disk/by-uuid/5251-9B85";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+          mountOptions = ["fmask=0077" "dmask=0077"];
+        };
+      };
+
+      nixos = {
+        type = "disk";
+        device = "/dev/disk/by-uuid/e3110976-78ee-4868-94c4-a3c052aee359";
+        content = {
+          type = "luks";
+          name = "crypted";
+          settings = {
+            allowDiscards = true;
+            bypassWorkqueues = true;
+          };
+          content = {
+            type = "btrfs";
+            extraArgs = ["-f"];
+            subvolumes = {
+              "/nix" = {
+                mountpoint = "/nix";
+                mountOptions = ["compress=zstd" "noatime"];
+              };
+              "/persist" = {
+                mountpoint = "/persist";
+                mountOptions = ["compress=zstd" "noatime"];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  fileSystems."/persist".neededForBoot = true;
+}

hosts/laptop/flake.nix

@@ -19,6 +19,8 @@ nixpkgs.lib.nixosSystem {
     inputs.nix-index-database.nixosModules.default
     inputs.helium-browser.nixosModules.default
     inputs.impermanence.nixosModules.impermanence
+    inputs.disko.nixosModules.disko
+    ./disko.nix
     ./configuration.nix
   ];
 }

hosts/laptop/hardware-configuration.nix

@@ -1,6 +1,4 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
+# Hardware detection - filesystems are managed by disko.nix
 {
   config,
   lib,
@@ -11,42 +9,13 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
-    "nvme"
-    "xhci_pci"
-    "uas"
-    "usbhid"
-    "sd_mod"
-  ];
+  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage" "usbhid" "uas" "sd_mod"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-amd"];
   boot.extraModulePackages = [];
 
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/6320d3c6-0231-45ec-817a-c6f0e39aab73";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/5251-9B85";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
   swapDevices = [];
 
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp7s0f4u1u4.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

nixos/users.nix

@@ -17,6 +17,9 @@ in {
         "networkmanager"
         "wheel"
       ];
+      # CHANGEME: Set your password with: mkpasswd -m sha-512
+      # Or use initialPassword for first boot, then change it
+      initialPassword = "nixos";
     };
   };
 }