Secure Boot -> Secure Boot Enable -> Select "Disabled"
System Configuration -> SATA Operation -> Select "AHCI"
Power Management -> USB Wake Support -> Select "Enable USB Wake Support"
setfont latarcyrheb-sun32
systemctl start display-manager
gdisk /dev/nvme0n1
o (create new empty partition table)
n (add partition, Partition number 1, 500M, type ef00 EFI)
n (add partition, remaining space, type 8300 Linux LVM)
w (write partition table and exit)
When you are done, you will have the following.
Part. Number | End Sector Size | Code | Purpose | Codename |
---|---|---|---|---|
1 | +500M |
EF00 |
EFI partition | n/a |
2 | +3M |
8300 |
cryptsetup luks key | cryptkey |
3 | +16G |
8300 |
swap space (hibernation) | cryptswap |
4 | remaining (222 GiB) | 8300 |
root filesystem | cryptroot |
# Create an encrypted disk to hold our key, the key to this drive
# is what you'll type in to unlock the rest of your drives... so,
# remember it:
$ cryptsetup luksFormat /dev/nvme0n1p2
$ cryptsetup luksOpen /dev/nvme0n1p2 cryptkey
# Fill our key disk with random data, wihch will be our key:
$ dd if=/dev/random of=/dev/mapper/cryptkey bs=1024 count=14000
# Use the encrypted key to create our encrypted swap:
$ cryptsetup luksFormat --key-file=/dev/mapper/cryptkey /dev/nvme0n1p3
# Create an encrypted root with a key you can remember.
$ cryptsetup luksFormat /dev/nvme0n1p4
# Now add the cryptkey as a decryption key to the root partition, this
# way you can only decrypt the cryptkey on startup, and use the
# cryptkey to decrypt the root.
#
# The first human-rememberable key we added is just in case.
$ cryptsetup luksAddKey /dev/nvme0n1p4 /dev/mapper/cryptkey
# Now we open the swap and the root and make some filesystems.
$ cryptsetup luksOpen --key-file=/dev/mapper/cryptkey /dev/nvme0n1p3 cryptswap
$ mkswap /dev/mapper/cryptswap
$ cryptsetup luksOpen --key-file=/dev/mapper/cryptkey /dev/nvme0n1p4 cryptroot
$ mkfs.ext4 /dev/mapper/cryptroot
# and rebuild the boot partition:
$ mkfs.vfat /dev/nvme0n1p1
nixos-generate-config --root /mnt
nixos-install --chroot
passwd jason
exit
reboot
nixos-rebuild boot
nixos-rebuild switch
If your NixOS boot does not work, you mess up, or need to reboot for any reason, just boot from your USB drive in UEFI mode like before. To re-setup everything so you can fix the NixOS configuration
cryptsetup luksOpen /dev/nvme0n1p2 cryptkey
cryptsetup luksOpen --key-file=/dev/mapper/cryptkey /dev/nvme0n1p3 cryptswap
cryptsetup luksOpen --key-file=/dev/mapper/cryptkey /dev/nvme0n1p4 cryptroot
mount /dev/disk/by-uuid/4543 /mnt
mkdir -p /mnt/boot
mount /dev/disk/by-uuid/86CE /mnt/boot