mirror/github.com-tboerger-nixos-config
1
0
Fork 0
mirror of https://github.com/tboerger/nixos-config synced 2024-11-26 07:43:45 +01:00
Code Issues

chore: enable luks encryption for anubis

Browse Source
This commit is contained in:
Thomas Boerger 2022-11-22 20:59:46 +01:00
parent c589247d7a
commit c854f7145c
No known key found for this signature in database
GPG Key ID: 09745AFF9D63C79B
3 changed files with 30 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
desktops/anubis/boot.nix
View File

@ -16,19 +16,21 @@
canTouchEfiVariables = true; canTouchEfiVariables = true;
}; };
systemd-boot = { grub = {
enable = true; enable = true;
consoleMode = "2"; version = 2;
configurationLimit = 5; device = "nodev";
editor = false; efiSupport = true;
}; };
}; };
# kernelParams = [ "intel_pstate=no_hwp" ];
kernelModules = [ ]; kernelModules = [ ];
extraModulePackages = with config.boot.kernelPackages; [ acpi_call ]; extraModulePackages = with config.boot.kernelPackages; [ acpi_call ];
initrd = { initrd = {
availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" "acpi_call" ]; availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" "acpi_call" "cryptd" ];
kernelModules = [ "dm-snapshot" ]; kernelModules = [ "dm-snapshot" ];
}; };
}; };

15
desktops/anubis/filesystems.nix
View File

@ -1,6 +1,21 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ {
boot = {
initrd = {
luks = {
devices = {
luks = {
name = "luks";
device = "/dev/disk/by-partlabel/system";
preLVM = true;
allowDiscards = true;
};
};
};
};
};
swapDevices = [{ swapDevices = [{
device = "/dev/disk/by-label/swap"; device = "/dev/disk/by-label/swap";
}]; }];

10
desktops/anubis/partitions.sh
View File

@ -61,11 +61,17 @@ echo "-----> Wait for partitions"
sleep 3 sleep 3
sync sync
echo "-----> Format encrypted container"
cryptsetup luksFormat /dev/disk/by-partlabel/system
echo "-----> Open encrypted container"
cryptsetup luksOpen /dev/disk/by-partlabel/system crypted
echo "-----> Create data pv" echo "-----> Create data pv"
pvcreate /dev/disk/by-partlabel/system pvcreate /dev/mapper/crypted
echo "-----> Create data vg" echo "-----> Create data vg"
vgcreate system /dev/disk/by-partlabel/system vgcreate system /dev/mapper/crypted
echo "-----> Create swap volume" echo "-----> Create swap volume"
lvcreate -y --size $(cat /proc/meminfo | grep MemTotal | cut -d':' -f2 | sed 's/ //g') --name swap system lvcreate -y --size $(cat /proc/meminfo | grep MemTotal | cut -d':' -f2 | sed 's/ //g') --name swap system