Basic Full-Disk Encrypted ZFS Thinkpad (w/ 512 sector SSD) booted from USB key

configuration.nix

# Basic Full-Disk Encrypted ZFS Thinkpad (w/ 512 sector SSD) booted from USB key

# EFI/BOOT:
#   export BOOT=/dev/disk/by-id/usb-SanDisk_Ultra_Fit_4C530001011030101042-0\:0
#   parted --script $BOOT -- \
#     mklabel gpt \
#     mkpart esp fat32 1MiB 512MiB \
#     mkpart primary 512MiB 100% \
#     set 1 boot on
#   mkfs.vfat -n BOOT $BOOT-part1

# ZFS:
#   export ROOT=/dev/disk/by-id/nvme-WDC_PC_SN730_SDBQNTY-1T00-1001_2018JE446304
#   zpool create -f \
#     -o ashift=9 \
#     -O compression=on \
#     -O encryption=on \
#     -O keyformat=passphrase \
#     -O mountpoint=none \
#     laptop \
#     $ROOT
#   zfs create -o refreservation=1G -o mountpoint=none              laptop/reserved
#   zfs create -o mountpoint=none                                   laptop/local
#   zfs create -o mountpoint=legacy                                 laptop/local/nix
#   zfs create -o mountpoint=none                                   laptop/system
#   zfs create -o mountpoint=legacy                                 laptop/system/root
#   zfs create -o mountpoint=legacy -o xattr=sa -o acltype=posixacl laptop/system/var
#   zfs create -o mountpoint=none                                   laptop/user
#   zfs create -o mountpoint=legacy                                 laptop/user/home
#   zfs set com.sun:auto-snapshot=true                              laptop/user

# INSTALL:
#   mount -t zfs laptop/system/root /mnt
#   mkdir /mnt/{nix,var,home,boot}
#   mount -t zfs laptop/local/nix   /mnt/nix
#   mount -t zfs laptop/system/var  /mnt/var
#   mount -t zfs laptop/user/home   /mnt/home
#   mount -t vfat $BOOT-part1       /mnt/boot
#   nixos-generate-config --root /mnt

{ config, pkgs, ... }:

let
  privateZeroTierInterfaces = [
    "ztr2qxf557" # vpn
  ];
in
{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
    ];

  # NIX / NIXOS
  nix.autoOptimiseStore = true;
  nixpkgs.config.allowUnfree = true;
  nixpkgs.config.pulseaudio = true;
  system.stateVersion = "20.09";

  # BOOT
  boot.kernelParams = [ "consoleblank=90" ];
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.systemd-boot.enable = true;

  # ZFS
  boot.initrd.supportedFilesystems = [ "zfs" ];
  boot.supportedFilesystems = [ "zfs" ];
  boot.zfs.enableUnstable = true;
  services.zfs.autoScrub.enable = true;
  services.zfs.autoSnapshot.enable = true;
  services.zfs.autoSnapshot.frequent = 8;
  services.zfs.autoSnapshot.monthly = 1;
  services.zfs.trim.enable = true;

  # HARDWARE
  hardware.bluetooth.enable = true;
  hardware.cpu.intel.updateMicrocode = true;
  hardware.opengl.driSupport = true;
  hardware.opengl.driSupport32Bit = true;
  hardware.opengl.enable = true;
  hardware.pulseaudio.enable = true;
  hardware.pulseaudio.extraModules = [ pkgs.pulseaudio-modules-bt ];
  hardware.pulseaudio.support32Bit = true;
  hardware.pulseaudio.zeroconf.discovery.enable = true;
  hardware.pulseaudio.zeroconf.publish.enable = true;
  hardware.sane.enable = true;
  hardware.video.hidpi.enable = true;
  sound.enable = true;

  # NETWORKING
  networking.firewall.enable = false;
  networking.firewall.trustedInterfaces = privateZeroTierInterfaces;
  networking.hostId = "a751b2ef"; # cut -c-8 </proc/sys/kernel/random/uuid
  networking.hostName = "mahlaptop";
  networking.nameservers = [
    "2606:4700:4700::1111" # CloudFlare
    "8.8.8.8"              # Google
  ];
  networking.networkmanager.enable = true;
  networking.networkmanager.wifi.powersave = true;

  # mDNS
  services.avahi.enable = true;
  services.avahi.interfaces = privateZeroTierInterfaces;
  services.avahi.nssmdns = true;
  services.avahi.publish.addresses = true;
  services.avahi.publish.domain = true;
  services.avahi.publish.enable = true;
  services.avahi.publish.userServices = true;
  services.avahi.publish.workstation = true;

  # LOCALE
  i18n.defaultLocale = "en_US.UTF-8";
  time.timeZone = "America/Los_Angeles";

  # INPUT
  console.useXkbConfig = true;
  services.xserver.layout = "us";
  services.xserver.libinput.disableWhileTyping = true;
  services.xserver.libinput.enable = true;
  services.xserver.libinput.naturalScrolling = true;
  services.xserver.synaptics.twoFingerScroll = true;
  services.xserver.xkbOptions = "ctrl:nocaps,compose:ralt";
  services.xserver.xkbVariant = "dvorak";

  # GPG
  programs.gnupg.agent.enable = true;

  # SSH
  services.openssh.enable = true;
  services.openssh.openFirewall = false;

  # ANDROID
  programs.adb.enable = true;

  # KEYBASE
  services.kbfs.enable = true;

  # ZEROTIER
  services.zerotierone.enable = true;
  services.zerotierone.joinNetworks = [
    "8056c2e21c000001" # earth.zerotier.net (PUBLIC)
    "565799e8f6da2f47" # vpn                (PRIVATE)
  ];

  # VM
  virtualisation.docker.autoPrune.enable = true;
  virtualisation.docker.enable = true;
  virtualisation.docker.storageDriver = "zfs";
  virtualisation.libvirtd.enable = true;

  # USERS
  users.extraUsers.me.description = "Computer User";
  users.extraUsers.me.isNormalUser = true;
  users.extraUsers.me.extraGroups = [
    "adbusers"
    "audio"
    "dialout"
    "docker"
    "kvm"
    "libvirtd"
    "lp"
    "networkmanager"
    "power"
    "scanner"
    "video"
    "wheel"
  ];
  users.extraUsers.me.openssh.authorizedKeys.keys = [
    "ssh-rsa ...."
  ];
}