Best so far, need to test rearranging encryption but impermanence works

configuration.nix 3

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running `nixos-help`).

{ config, pkgs, lib, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
"${builtins.fetchTarball "https://github.com/nix-community/disko/archive/master.tar.gz"}/module.nix"
"${builtins.fetchTarball "https://github.com/nix-community/impermanence/archive/master.tar.gz"}/nixos.nix"
    ];
disko.devices = import ./disko-config.nix {
disks = [ "/dev/vda" "/dev/vdb" "/dev/vdc"];
};

  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;

   boot.loader.grub.efiSupport = true;
   boot.loader.grub.efiInstallAsRemovable = true;
  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
  # Define on which hard drive you want to install Grub.
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
boot.supportedFilesystems = [ "zfs" ];
boot.initrd.checkJournalingFS = false;

networking.hostId = "758e9b4e";
networking.useDHCP = true;
services.zfs.autoSnapshot.enable = true;
services.zfs.autoScrub.enable = true;

boot.initrd.postDeviceCommands = lib.mkAfter ''
  zfs rollback -r rpool/root/nixos@blank
'';

boot.zfs.devNodes = "/dev/disk/by-partuuid"; # for vm usage only

environment.persistence."/persist/system" = {
  directories = [
    "/etc/nixos"
    "/var/log"
    "/var/lib"
  ];
  files = [
    "/etc/machine-id"
  ];
};
fileSystems."/persist".neededForBoot = true;



   networking.hostName = "nixos"; # Define your hostname.
  # Pick only one of the below networking options.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.

  # Set your time zone.
  # time.timeZone = "Europe/Amsterdam";

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Select internationalisation properties.
  # i18n.defaultLocale = "en_US.UTF-8";
  # console = {
  #   font = "Lat2-Terminus16";
  #   keyMap = "us";
  #   useXkbConfig = true; # use xkbOptions in tty.
  # };

  # Enable the X11 windowing system.
  # services.xserver.enable = true;


  

  # Configure keymap in X11
  # services.xserver.layout = "us";
  # services.xserver.xkbOptions = "eurosign:e,caps:escape";

  # Enable CUPS to print documents.
  # services.printing.enable = true;

  # Enable sound.
  # sound.enable = true;
  # hardware.pulseaudio.enable = true;

  # Enable touchpad support (enabled default in most desktopManager).
  # services.xserver.libinput.enable = true;

  system.copySystemConfiguration = true;
  users.mutableUsers = false;
  users.users.root.initialPassword = "ilovelego123";
  # Define a user account. Don't forget to set a password with ‘passwd’.
   users.users.alice = {
     isNormalUser = true;
     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
     packages = with pkgs; [
       firefox
       tree
     ];
  #   initialHashedPassword = "$6$4p8UvsZXVb.3yN.0$SL6BxUbvmDd17xqb3KOET8zu2UtbhOeYhIg0.50cFC5/UQV.hJSVT66mAWcgNxDYn0VtAar/KLTJkL16slcKc0";
    passwordFile = "/persist/passwords/alice";

   };

  # List packages installed in system profile. To search, run:
  # $ nix search wget
   environment.systemPackages = with pkgs; [
     vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
     wget
curl
   ];

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;

  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;

  # Copy the NixOS configuration file and link it from the resulting system
  # (/run/current-system/configuration.nix). This is useful in case you
  # accidentally delete configuration.nix.
  # system.copySystemConfiguration = true;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It's perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?

}

disko-config.nix 3

{disks,...}:{
    disk = {
      x = {
        type = "disk";
        device = "/dev/vda";
        content = {
          type = "gpt";
          partitions = {
            GRUB = {
              size = "1M";
              type = "EF02";
            };
            ESP = {
              size = "1G";
              type = "EA00";
              content = {
                type = "filesystem";
                format = "vfat";
                mountpoint = "/boot";
              };
            };
            zfs = {
              size = "100%";
              content = {
                type = "zfs";
                pool = "rpool";
              };
            };
          };
        };
      };
      y = { 
        type = "disk";
        device = "/dev/vdb";
        content = {
          type = "gpt";
          partitions = {
            mdadm = {
              size = "100%";
              content = {
                type = "mdraid";
                name = "raid0";
              };
            };
          };
        };
      };
      z = { 
        type = "disk";
        device = "/dev/vdc";
        content = {
          type = "gpt";
          partitions = {
            mdadm = {
              size = "100%";
              content = {
                type = "mdraid";
                name = "raid0";
              };
            };
          };
        };
      };
    };
      mdadm = { 
        "raid0" = {
          type = "mdadm";
          level = 0;
          content = {
            type = "gpt";
            partitions = {
              primary = {
                size = "100%";
                content = {
                  type = "zfs";
                  pool = "rpool";
                };
              };
            };
          };
        };
      };
    zpool = {
      rpool = {
        type = "zpool";
        rootFsOptions = {
          compression = "zstd";
        };

        datasets = {
          "root" = {
            type = "zfs_fs";
            options.mountpoint = "none";
            options.encryption = "aes-256-gcm";
            options.keyformat = "passphrase";
            options.keylocation = "file:///tmp/secret.key";
            postCreateHook = ''
              zfs set keylocation="prompt" "rpool/$name";
            '';
          };
          "root/nixos" = {
            type = "zfs_fs";
            options.mountpoint = "legacy";
            mountpoint = "/";
            postCreateHook = ''
              zfs snapshot rpool/root/nixos@blank;
            '';
          };
          "safe/nix" = {
            mountpoint = "/nix";
            type = "zfs_fs";
            options.mountpoint = "legacy";
          };
          "safe/persist" = {
            mountpoint = "/persist";
            type = "zfs_fs";
            options.mountpoint = "legacy";
          };
        };
      };
    };
}

nix run --extra-experimental-features "nix-command flakes" github:nix-community/disko -- --mode disko /tmp/disko-config.nix --arg disks '[ "/dev/vda" "/dev/vdb" "/dev/vdc" ]'