NixOS Installation

Prepare the USB drive

• Format the USB drive as FAT
• Change its label to NIXOS_ISO (or whatever blkid says)

Populate the USB drive

• Mount the ISO
• Copy its contents to the USB drive

Configure UEFI

This step is only required if installing on a newer system with UEFI.

• Disable Secure Boot Control
• Enable Launch CSM
• Set first boot option to UEFI: USB Flash DISK 1100

Partition the hard drive

Depending on the system, fdisk might work, or gdisk might be needed.

Using fdisk on /dev/sda:

• Create partition 1 with 512MB and type ef for EFI (FAT-12/16/32)
• Create partition 2 with the rest of the drive and type8e for Linux LVM

Using gdisk on /dev/sda:

• Create partition 1 with 512MB and type ef00
• Create partition 2 with the rest of the drive and type 8e00 for Linux LVM

Set up encryption

# cryptsetup luksFormat /dev/sda2
# cryptsetup luksOpen /dev/sda2 enc-pv
# pvcreate /dev/mapper/enc-pv
# vgcreate vg /dev/mapper/enc-pv
# lvcreate -L 8G -n swap vg
# lvcreate -l 28355 -n root vg

Format partitions

# mkfs.fat /dev/sda1
# mkfs.ext4 -O dir_index -j -L root /dev/vg/root
# mkswap -L swap /dev/vg/swap

Mount partitions

# mount /dev/vg/root /mnt
# mkdir /mnt/boot
# mount /dev/sda1 /mnt/boot
# swapon /dev/vg/swap

Optional: Set up RAID 1 for /home

# sudo mdadm --create --verbose /dev/md0 --level=0 --raid-devices=2 /dev/sdc /dev/sdd
# mkfs.ext4 -F /dev/md0
# mkdir /mnt/home
# mount /dev/md0 /mnt/home

Install NixOS

# nixos-generate-config --root /mnt
# vim /mnt/etc/nixos/configuration.nix
# nixos-install

Decrypt on boot

/etc/nixos/configuration.nix:

boot.initrd.luks.devices = {
  root = {
    device = "/dev/disk/by-uuid/abc-123-symlink-to-dev-sda2";
    preLVM = true;
  };
};

Fix wpa_supplicant

Add this to /etc/wpa_supplicant.conf:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
update_config=1

network={
  ssid="prettyflyforawifi"
  psk="alligator3"
  proto=RSN
  key_mgmt=WPA-PSK
  pairwise=CCMP
  auth_alg=OPEN
  bgscan="simple:30:-45:300"
}

Restart wpa_supplicant:

# systemctl restart wpa_supplicant