Bootable NixOS USB stick for kiosk or demo usage

configuration.nix

{ config, lib, pkgs, ... }:

with lib;

{
  imports = [
    # ISO image
    <nixpkgs/nixos/modules/installer/cd-dvd/iso-image.nix>
    # Hardware support similar to installer Live CD
    <nixpkgs/nixos/modules/profiles/all-hardware.nix>
    <nixpkgs/nixos/modules/installer/scan/detected.nix>
    <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
  ];

  # ISO image configuration
  isoImage.isoName = "NixOS-${config.system.nixosLabel}-${pkgs.stdenv.system}.iso";
  isoImage.volumeID = substring 0 11 "NIXOS_ISO";
  isoImage.makeEfiBootable = true;
  isoImage.makeUsbBootable = true;
  isoImage.appendToMenuLabel = "";

  # Newers available Kernel
  boot.kernelPackages = pkgs.linuxPackages_latest;

  # Silent boot
  boot.consoleLogLevel = 0;
  boot.loader.timeout = pkgs.lib.mkForce 0;

  # Network Manager
  networking.networkmanager.enable = true;

  # Kiosk user
  users.users.user = {
    isNormalUser = true;
    description = "User";
    home = "/home/user";
    extraGroups = [
      "audio"
      "input"
      "networkmanager"
      "video"
    ];
    uid = 1000;
  };
  security.sudo.enable = false;

  # Kiosk X11
  services.xserver.enable = true;
  services.xserver.config = ''
    Section "ServerFlags"
      Option  "DontVTSwitch"  "True"
    EndSection
  '';
  services.xserver.synaptics.enable = true;
  services.xserver.displayManager.auto.enable = true;
  services.xserver.displayManager.auto.user = "user";
  services.xserver.desktopManager.xterm.enable = false;
  services.xserver.windowManager.default = "i3";
  services.xserver.windowManager.i3.enable = true;
  services.xserver.windowManager.i3.configFile = pkgs.writeText "config" ''
    set $mod Mod4

    new_window 1pixel
    for_window [class="Surf"] fullscreen

    exec --no-startup-id nm-applet
    exec surf -k "https://www.google.com/"
  '';

  environment.systemPackages = with pkgs; [
    surf
    i3status
    networkmanagerapplet
  ];
}

default.nix

(import <nixpkgs/nixos/lib/eval-config.nix> {
  system = "x86_64-linux";
  modules = [ ./configuration.nix ];
}).config.system.build.isoImage

iso-image.patch

diff -Nru a/iso-image.nix b/iso-image.nix
--- a/iso-image.nix	2016-09-22 21:55:43.876193129 +0300
+++ b/iso-image.nix	2016-09-22 21:55:07.186183295 +0300
@@ -61,10 +61,22 @@
 
   isolinuxCfg = baseIsolinuxCfg + (optionalString config.boot.loader.grub.memtest86.enable isolinuxMemtest86Entry);
 
+  PreLoader = pkgs.fetchurl {
+    url = "http://blog.hansenpartnership.com/wp-uploads/2013/PreLoader.efi";
+    md5 = "4f7a4f566781869d252a09dc84923a82";
+  };
+
+  HashTool = pkgs.fetchurl {
+    url = "http://blog.hansenpartnership.com/wp-uploads/2013/HashTool.efi";
+    md5 = "45639d23aa5f2a394b03a65fc732acf2";
+  };
+
   # The EFI boot image.
   efiDir = pkgs.runCommand "efi-directory" {} ''
     mkdir -p $out/EFI/boot
-    cp -v ${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${targetArch}.efi $out/EFI/boot/boot${targetArch}.efi
+    cp -v ${HashTool} $out/EFI/boot/HashTool.efi
+    cp -v ${PreLoader} $out/EFI/boot/boot${targetArch}.efi
+    cp -v ${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${targetArch}.efi $out/EFI/boot/loader.efi
     mkdir -p $out/loader/entries
 
     echo "title NixOS Live CD" > $out/loader/entries/nixos-livecd.conf
@@ -296,7 +308,7 @@
         config.system.build.toplevel.drvPath;
 
     # Create the squashfs image that contains the Nix store.
-    system.build.squashfsStore = import ../../../lib/make-squashfs.nix {
+    system.build.squashfsStore = import <nixpkgs/nixos/lib/make-squashfs.nix> {
       inherit (pkgs) stdenv squashfsTools perl pathsFromGraph;
       storeContents = config.isoImage.storeContents;
     };
@@ -345,7 +357,7 @@
     boot.loader.timeout = 10;
 
     # Create the ISO image.
-    system.build.isoImage = import ../../../lib/make-iso9660-image.nix ({
+    system.build.isoImage = import <nixpkgs/nixos/lib/make-iso9660-image.nix> ({
       inherit (pkgs) stdenv perl pathsFromGraph xorriso syslinux;
 
       inherit (config.isoImage) isoName compressImage volumeID contents;