| 22 Dec 2024 |
 waltmck | * I'm not sure yet. I have used it with nixos-anywhere in the past to deploy to headless servers, but it may be difficult since I am trying to set up encrypted root. I have physical access to this machine | 00:21:49 |
 Enzime | In reply to @waltmck:matrix.org
I'm not sure yet. I have used it with nixos-anywhere in the past to deploy to headless servers, but it may be difficult since I am trying to set up encrypted root. I have physical access to this machine it should work fine with nixos-anywhere | 00:23:53 |
| Enzime | I'm not sure if I've tested if the prompting for passwords works correctly over SSH though | 00:24:07 |
| Enzime | it should work | 00:24:23 |
| Enzime | https://github.com/nix-community/nixos-anywhere/blob/main/docs/cli.md?plain=1#L41-L43 | 00:24:48 |
| waltmck | I'll check! | 00:24:59 |
| Enzime | In reply to @enzime:nixos.dev
https://github.com/nix-community/nixos-anywhere/blob/main/docs/cli.md?plain=1#L41-L43 this option is for if you want to write the password from a file and read it from that file | 00:25:16 |
| Enzime | you'll need to set the corresponding passwordFile though for your luks | 00:25:40 |
| Enzime | you shouldn't need to use this flag if you want to prompt for your password | 00:26:16 |
| waltmck | I'm not using luks, I'm using zfs native encryption | 00:27:10 |
| waltmck | but I set keylocation="prompt", I'll see if that works | 00:27:45 |
| waltmck | Do you see anything obviously stupid in my config? | 00:28:06 |
| waltmck | (I separated the datasets part into a different file from the vdev part) | 00:28:46 |
| Enzime | oh... I'm not sure if we've implemented any ZFS encryption password handling code | 00:28:57 |
| Enzime | is there a particular reason you want to use ZFS native encryption? | 00:29:26 |
| waltmck | So that I can zfs send incremental encrypted backups to an offsite server, primarily | 00:29:55 |
| Enzime | just wanted to make sure you have an actual usecase as I still see a lot of people recommending to avoid ZFS native encryption | 00:31:02 |
| waltmck | yeah, I know there are some pitfalls | 00:31:27 |
| Enzime | In reply to @waltmck:matrix.org
but I set keylocation="prompt", I'll see if that works I think it should work | 00:33:17 |
| Enzime | https://github.com/nix-community/disko/blob/master/lib/types/zfs_volume.nix#L71-L75 | 00:33:23 |
| Enzime | there is some code for ZFS native encryption support in disko already | 00:33:36 |
| Enzime | In reply to @waltmck:matrix.org
Do you see anything obviously stupid in my config? it looks fine to me | 00:35:01 |
| Enzime | is there a reason you have enc/state/root if you have sys as well | 00:35:23 |
| Enzime | as an immutable root? | 00:35:25 |
| waltmck | sys is unencrypted | 00:35:37 |
| Enzime | why not just encrypt it all? | 00:36:19 |
| Enzime | I'm not sure if you already have code to auto-rollback the root on each boot, you should be able to do something like:
https://github.com/Enzime/dotfiles-nix/blob/main/hosts/sigma/hardware-configuration.nix#L57-L59
https://github.com/Enzime/dotfiles-nix/blob/main/modules/impermanence.nix#L20-L31 | 00:37:16 |
| waltmck | That would also be reasonable. I don't see why it would necessarily be better than encrypting just the mutable parts | 00:37:16 |
| Enzime | In reply to @waltmck:matrix.org
That would also be reasonable. I don't see why it would necessarily be better than encrypting just the mutable parts I guess it would just simplify because you could make sys your rootfs dataset and have one less dataset | 00:37:43 |
| waltmck | In reply to @enzime:nixos.dev
I'm not sure if you already have code to auto-rollback the root on each boot, you should be able to do something like:
https://github.com/Enzime/dotfiles-nix/blob/main/hosts/sigma/hardware-configuration.nix#L57-L59
https://github.com/Enzime/dotfiles-nix/blob/main/modules/impermanence.nix#L20-L31 yeah, I do that on my laptop. I think it's more inconvenience than it's worth so I'm planning on scrapping it | 00:37:44 |
