!oNSIfazDqEcwhcOjSL:matrix.org

disko

352 Members
disko - declarative disk partitioning - https://github.com/nix-community/disko89 Servers

Load older messages


SenderMessageTime
28 Apr 2025
@realhotgirlshit:envs.net@realhotgirlshit:envs.net Does disko-install change a partition’s UUID every time it’s run? 23:36:47
@cent:neuland.enterprises@cent:neuland.enterprises left the room.23:39:13
29 Apr 2025
@hexa:lossy.networkhexaprobably, yeah01:21:52
@hexa:lossy.networkhexabut you can use the disko config to populate mountpoints01:22:24
@hexa:lossy.networkhexaso that's a non-issue for mounting 01:22:34
@lassulus:lassul.uslassulusI think you can specify uuids now. But i never tested it01:28:39
@realhotgirlshit:envs.net@realhotgirlshit:envs.net I’m trying to install NixOS through disko with a BTRFS partitions/full disk encrypted setup. I’ve changed the configuration in a couple different ways, and ran disko-install, each time. GRUB always allows two password entries telling me Invalid password, and a third attempt which ends with a cryptodisk not found meltdown and rescue prompt.

The changes I’ve made recently:
  1. Change all UUID partition references to /dev/sda or /dev/sda2.

  2. Made sure that btrfs was present during boot.

  3. Expanded the boot device definition to have more details vs. the previous version which just had the path.


Relevant configuration.nix:

  # Disable UEFI.
  boot.loader.systemd-boot.enable = false;

  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  boot.loader.grub.efiSupport = false;
  boot.loader.grub.enableCryptodisk = true;

  boot.loader.efi.canTouchEfiVariables = false;
  # boot.loader.grub.efiInstallAsRemovable = true;
  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
  # Define on which hard drive you want to install Grub.
  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only

  
  boot.initrd.luks.devices.cryptroot.devices = [
    {
      name = "luksroot";
      device = "/dev/sda2";
    }
  ];

  boot.initrd.supportedFilesystems = [ "btrfs" ];

Disko configuration in flake.nix:
{
  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
  inputs.disko.url = "github:nix-community/disko/latest";
  inputs.disko.inputs.nixpkgs.follows = "nixpkgs";

  outputs = {self, disko, nixpkgs }: {
    nixosConfigurations.koolthing = nixpkgs.legacyPackages.x86_64-linux.nixos [
      ./configuration.nix
      disko.nixosModules.disko
      {
        disko.devices = {
	  disk = {
          main = {
            type = "disk";
            device = "/dev/sda";
            content = {
              type = "gpt";
              partitions = {
                # Legacy BIOS, MBR-style partition table.
                boot = {
                  size = "1M";
                  type = "EF02"; # Grub MBR.
                };

                # The LUKS-encrypted root.
                luks = {
                  size = "300G";
                  content = {
                    type = "luks";
                    name = "crypted";

                    # Set up with an interactive password and not a keyfile.
                    settings = {
                      allowDiscards = true;
                    };

                    # The Btrfs filesystem.
                    content = {
                      type = "btrfs";
                      extraArgs = ["-f"]; # Overwrite any existing file system.
                      subvolumes = {
                        "/root" = {
                          mountpoint = "/";
                          mountOptions = [
                            "compress=zstd"
                            "noatime"
                          ];
                        };

                        # The home subvolume.
                        "/home" = {
                          mountpoint = "/home";                          
                          mountOptions = [
                            "compress=zstd"
                            "noatime"
                          ];
                        };

                        # The nix subvolume.
                        "/nix" = {
                          mountpoint = "/nix";                          
                          mountOptions = [
                            "compress=zstd"
                            "noatime"
                          ];
                        };
                      };
                    };
                  };
                };
              };
            };
          };
	};
        };
      }
    ];
  };
}
01:43:10
@lassulus:lassul.uslassulusRemove the enableCryptoDisk Option from grub. This is used for encrypted /Boot partitions02:00:08
@lassulus:lassul.uslassulusOh wait that seems to be what you want to do?02:00:32
@lassulus:lassul.uslassulusDies grub support btrfs for finding the kernel?02:01:53
@realhotgirlshit:envs.net@realhotgirlshit:envs.net I didn’t know that, but I think that’s what I want 02:07:04
@realhotgirlshit:envs.net@realhotgirlshit:envs.net If not, I will not encrypt /boot 02:07:54
@lassulus:lassul.uslassulusIt could be that grub only supports luks1 but we do luks2 nowadays02:15:40
@lassulus:lassul.uslassulusI used the grub unlockaing years ago. But it was pretty slow and frustrating :D02:16:12
@lassulus:lassul.uslassulusMaybe this is better if you boot the machine via efi instead of legacy. But not sure02:16:35
@realhotgirlshit:envs.net@realhotgirlshit:envs.net Yeah, my machine doesn’t support legacy 03:58:56
@realhotgirlshit:envs.net@realhotgirlshit:envs.netI’m looking up tutorials and see if they have anything useful03:59:07
@realhotgirlshit:envs.net@realhotgirlshit:envs.netI want to encrypt boot if possible03:59:16
@lassulus:lassul.uslassulusMaybe here is some context about luks2 support in grub: https://savannah.gnu.org/bugs/?5509304:49:38
@lassulus:lassul.uslassulusI haven't read it yet. So maybe you can check there04:50:21
@realhotgirlshit:envs.net@realhotgirlshit:envs.netOkay, so GRUB LUKS2 support is not great05:03:51
@realhotgirlshit:envs.net@realhotgirlshit:envs.netSo no encrypted /boot05:04:22
@realhotgirlshit:envs.net@realhotgirlshit:envs.netThat’s the only ramification, anything about FDE in general?05:04:58
@lassulus:lassul.uslassulusNo I usually do LUKS fde on all my computers05:07:42
@realhotgirlshit:envs.net@realhotgirlshit:envs.netWith GRUB?05:09:58
@lassulus:lassul.uslassulusThat doesnt matter usually. Since the kernel does the decryption in the initrd05:10:45
@lassulus:lassul.uslassulusI use grub or systemd-boot on different systems05:11:13
@realhotgirlshit:envs.net@realhotgirlshit:envs.netperfect 😁05:11:36
@realhotgirlshit:envs.net@realhotgirlshit:envs.netI’ll remove the cryptodisk stuff05:11:46
@lassulus:lassul.uslassulusYou have to add a /boot partition outside the luks also05:12:12

Show newer messages


Back to Room ListRoom Version: 10