John Boehr jbboehr

Installation of NixOS with encrypted root

These are my notes on instaling NixOS 16.03 on a Lenovo ThinkPad X1 Carbon (4th generation) with an encrypted root file system using UEFI.

Most of this is scrambled from the following pages:

This post is deprecated!

Its contents have been moved to the NixOS wiki here, where they are being kept up to date. Please follow the instructions there instead!

The original post is below for posterity.

General notes

nix-channel and ~/.nix-defexpr are gone. We'll use $NIX_PATH (or user environment specific overrides configured via nix set-path) to look up packages. Since $NIX_PATH supports URLs nowadays, this removes the need for channels: you can just set $NIX_PATH to e.g. https://nixos.org/channels/nixos-15.09/nixexprs.tar.xz and stay up to date automatically.
By default, packages are selected by attribute name, rather than the name attribute. Thus nix install hello is basically equivalent to nix-env -iA hello. The attribute name is recorded in the user environment manifest and used in upgrades. Thus (at least by default) hello won't be upgraded to helloVariant.

@vcunat suggested making this an arbitrary Nix expression rather than an attrpath, e.g. firefox.override { enableFoo = true; }. However, such an expression would not have a key in the user environment, unlike an attrpath. Better to require an explicit flag for this.

TBD: How to deal with search path clashes.

Don't use VPN services.

No, seriously, don't. You're probably reading this because you've asked what VPN service to use, and this is the answer.

Note: The content in this post does not apply to using VPN for their intended purpose; that is, as a virtual private (internal) network. It only applies to using it as a glorified proxy, which is what every third-party "VPN provider" does.

A Russian translation of this article can be found here, contributed by Timur Demin.
A Turkish translation can be found here, contributed by agyild.
There's also this article about VPN services, which is honestly better written (and has more cat pictures!) than my article.

Nix seems perfect for developers - until I try to use it...

Want to use Nix for development but you're not sure how? Concerned about the fluidity of nixpkgs channels or not being able to easily install arbitrary package versions?

When I first heard about Nix it seemed like the perfect tool for a developer. When I tried to actually use it for developing and deploying web apps, though, the pieces just didn't seem to add up.

Moved to git repository: https://github.com/denji/golang-tls

Generate private key (.key)

# Key considerations for algorithm "RSA" ≥ 2048-bit
openssl genrsa -out server.key 2048

# Key considerations for algorithm "ECDSA" ≥ secp384r1
# List ECDSA the supported curves (openssl ecparam -list_curves)

	rec {
	test1 = builtins.scopedImport { __nixPath = [ { path = test4; prefix="ssh-config-file"; } ] ++ __nixPath; };
	test2 = test1 <nixpkgs/pkgs/build-support/fetchgit/private.nix>;
	pkgs = import <nixpkgs> {};
	test3 = pkgs.callPackage test2 {};
	test4 = pkgs.writeText "sshd_config" ''
	# empty file, use programs.ssh.knownHosts in configuration.nix not StrictHostKeyChecking no
	'';
	test5 = test3 {
	url = "[email protected]:cleverca22/not-os.git";

	/**

	WHAT: A very simple example of redux + redux-simple-router using Typescript.

	WHY: The official example found here: https://github.com/rackt/redux-simple-router/tree/1.0.2/examples/basic has problems:
	1) it is spread over many files making it very hard to "skim"
	2) it is organized by function, not by feature. (Example: learning "how to manipulate redux state" is spread over 5 files in 4 folders)
	3) there are no comments explaining what's going on/why.

	WHO: by [email protected]

	#!/usr/bin/env python3
	import sys
	import getopt
	from PIL import Image

	xterm256colors = [ # http://pln.jonas.me/xterm-colors
	(0, (0x00, 0x00, 0x00)), # SYSTEM
	(1, (0x80, 0x00, 0x00)), # SYSTEM
	(2, (0x00, 0x80, 0x00)), # SYSTEM
	(3, (0x80, 0x80, 0x00)), # SYSTEM

	#!/bin/bash
	#
	# Copyright (c) 2015 W. Mark Kubacki <[email protected]>
	# Licensed under the terms of the RPL 1.5 for all usages
	# http://www.opensource.org/licenses/rpl1.5
	#

	set -e -o pipefail

	CAsubj="/C=DE/ST=Niedersachsen/L=Hannover/O=Dummy CA/CN=Sign-It-All"