enode: unencrypted disko btrfs setup attempt

1 files changed, 68 insertions, 72 deletions

diff --git a/hosts/enode/disko.nix b/hosts/enode/disko.nix
index d9dfb20..2f51ab4 100644
--- a/hosts/enode/disko.nix
+++ b/hosts/enode/disko.nix
@@ -4,75 +4,68 @@ let
     format = "vfat";
     mountpoint = "/boot";
     mountOptions = [
-      "default"
+      "umask=0077"
     ];
   };
-  cryptroot = {
-    type = "luks";
-    name = "cryptroot";
-    content = {
-      type = "btrfs";
-      extraArgs = [
-        "-L"
-        "nixos"
-        "-f"
-      ];
-      subvolumes = {
-        "/root" = {
-          mountpoint = "/";
-          mountOptions = [
-            "subvol=root"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/root-blank" = {
-          mountOptions = [
-            "subvol=root-blank"
-            "nodatacow"
-            "noatime"
-          ];
-        };
-        "/home" = {
-          mountpoint = "/home";
-          mountOptions = [
-            "subvol=home"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/nix" = {
-          mountpoint = "/nix";
-          mountOptions = [
-            "subvol=nix"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/persist" = {
-          mountpoint = "/persist";
-          mountOptions = [
-            "subvol=persist"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/lib" = {
-          mountpoint = "/var/lib";
-          mountOptions = [
-            "subvol=lib"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/log" = {
-          mountpoint = "/var/log";
-          mountOptions = [
-            "subvol=log"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
+  rootPartition = {
+    type = "btrfs";
+    extraArgs = [ "-f" ]; # override existing partition
+    subvolumes = {
+      "/root" = {
+        mountpoint = "/";
+        mountOptions = [
+          "subvol=root"
+          "compress=zstd"
+          "noatime"
+        ];
+      };
+      "/home" = {
+        mountOptions = [
+          "subvol=home"
+          "compress=zstd"
+          "noatime"
+        ];
+        mountpoint = "/home";
+      };
+      "/nix" = {
+        mountOptions = [
+          "subvol=nix"
+          "compress=zstd"
+          "noatime"
+        ];
+        mountpoint = "/nix";
+      };
+      "/log" = {
+        mountpoint = "/var/log";
+        mountOptions = [
+          "subvol=log"
+          "compress=zstd"
+          "noatime"
+        ];
+      };
+      "/lib" = {
+        mountpoint = "/var/lib";
+        mountOptions = [
+          "subvol=lib"
+          "compress=zstd"
+          "noatime"
+        ];
+      };
+      "/persist" = {
+        mountpoint = "/var/lib/persist";
+        mountOptions = [
+          "subvol=persist"
+          "compress=zstd"
+          "noatime"
+        ];
+      };
+      "/secrets" = {
+        mountpoint = "/var/lib/secrets";
+        mountOptions = [
+          "subvol=secrets"
+          "compress=zstd"
+          "noatime"
+        ];
       };
     };
   };
@@ -81,26 +74,29 @@ in
   disko.devices.disk.vm-disk = {
     type = "disk";
     device = "/dev/vda";
+    imageSize = "10G";
     content = {
       type = "gpt";
       partitions = {
         ESP = {
-          label = "boot";
+          priority = 1;
           name = "ESP";
+          label = "boot";
           size = "1G";
           type = "EF00";
           content = espPartition;
         };
-        luks = {
+        root = {
           size = "100%";
-          label = "luks";
-          content = cryptroot;
+          name = "root";
+          label = "root";
+          content = rootPartition;
         };
       };
     };
   };
 
+  fileSystems."/var/lib/persist".neededForBoot = true;
   fileSystems."/var/log".neededForBoot = true;
   fileSystems."/var/lib".neededForBoot = true;
-  fileSystems."/persist".neededForBoot = true;
 }