luishfonseca

# > sbctl status # should show "Secure Boot: Enabled"
# > sudo systemd-cryptenroll /dev/zvol/zroot/keyvol --unlock-key-file=/keyvol/sshvol_recovery.key --wipe-slot=tpm2
# > sudo systemd-cryptenroll /dev/zvol/zroot/keyvol --unlock-key-file=/keyvol/keyvol_recovery.key --tpm2-device=auto --tpm2-with-pin=(yes|no) --tpm2-pcrs=7
# if remote unlocking
# > sudo systemd-cryptenroll /dev/zvol/zroot/sshvol --unlock-key-file=/keyvol/sshvol_recovery.key --wipe-slot=tpm2
# > sudo systemd-cryptenroll /dev/zvol/zroot/sshvol --unlock-key-file=/keyvol/sshvol_recovery.key --tpm2-device=auto --tpm2-pcrs=7
{
  inputs,
  config,
  utils,

luishfonseca

# nix run --experimental-features "nix-command flakes" github:nix-community/disko -- --mode disko --flake ./nixos#zfs-boot
# nixos-install --no-root-password --flake ./nixos#zfs-boot
{...}: {
  disko.devices = {
    disk = {
      system0 = {
        type = "disk";
        device = "/dev/vda";
        content = {
          type = "gpt";

luishfonseca

system.activationScripts.diff = {
  supportsDryActivation = true;
  text = ''
    ${pkgs.nvd}/bin/nvd --nix-bin-dir=${pkgs.nix}/bin diff /run/current-system "$systemConfig"
  '';
};