machines/enzo/disko.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

# Declarative disk layout for enzo: LVM-on-LUKS with a btrfs root and an
# encrypted swap logical volume (>= RAM) for hibernation.
#
#   nvme0n1
#   ├─ p1  ESP   1 GiB  vfat  /boot            (unencrypted)
#   └─ p2  LUKS2 "crypted"  ── LVM vg "vg" ──
#           ├─ lv "swap"  swap  (hibernation target)
#           └─ lv "root"  btrfs subvolumes: @ @home @nix @log @snapshots
#
# Apply on the laptop with (prompts for the LUKS passphrase = fallback keyslot):
#   sudo nix run github:nix-community/disko/latest -- \
#     --mode destroy,format,mount ./machines/enzo/disko.nix
{ ... }:

{
  disko.devices = {
    disk.main = {
      type = "disk";
      device = "/dev/nvme0n1"; # TODO: confirm on the laptop with `lsblk`
      content = {
        type = "gpt";
        partitions = {
          ESP = {
            size = "1G";
            type = "EF00";
            content = {
              type = "filesystem";
              format = "vfat";
              mountpoint = "/boot";
              mountOptions = [ "umask=0077" ];
            };
          };
          luks = {
            size = "100%";
            content = {
              type = "luks";
              name = "crypted";
              settings = {
                # Allow TRIM through LUKS (minor metadata leak, fine for a laptop SSD).
                allowDiscards = true;
              };
              content = {
                type = "lvm_pv";
                vg = "vg";
              };
            };
          };
        };
      };
    };

    lvm_vg.vg = {
      type = "lvm_vg";
      lvs = {
        swap = {
          size = "20G"; # TODO: set >= RAM (RAM + a little) for hibernation
          content = {
            type = "swap";
            resumeDevice = true; # emits swapDevices + boot.resumeDevice
          };
        };
        root = {
          size = "100%FREE";
          content = {
            type = "btrfs";
            extraArgs = [ "-f" ];
            subvolumes = {
              "@" = {
                mountpoint = "/";
                mountOptions = [ "compress=zstd" "noatime" ];
              };
              "@home" = {
                mountpoint = "/home";
                mountOptions = [ "compress=zstd" "noatime" ];
              };
              "@nix" = {
                mountpoint = "/nix";
                mountOptions = [ "compress=zstd" "noatime" ];
              };
              "@log" = {
                mountpoint = "/var/log";
                mountOptions = [ "compress=zstd" "noatime" ];
              };
              "@snapshots" = {
                mountpoint = "/.snapshots";
              };
            };
          };
        };
      };
    };
  };
}