storopoli / flakes

NixOS/MacOS Nix Minimalist-Hardened-Privacy-oriented Configs

NixOS

This is paranoid build with root on tmpfs. This means that everything outside of some directories of /etc and some directories of /home will be wiped out. Read more about this in the NixOs Paranoid Guide (this is also a good source NixOS tmpfs as /home).

How to Install

1. Prepare a 64-bit nixos minimal iso image and burn it, then enter the live system. Suppose I have divided two partitions /dev/nvme0n1p1 /dev/nvme0n1p3

2. Format the partition:

   mkfs.fat -F 32 /dev/nvme0n1p1
   mkfs.ext4 /dev/nvme0n1p3 # or use LUKS

3. Mount:

   mount -t tmpfs none /mnt
   mkdir -p /mnt/{boot,nix,etc/nixos}
   mount /dev/nvme0n1p3 /mnt/nix
   mount /dev/nvme0n1p1 /mnt/boot
   mkdir -p /mnt/nix/persist/etc/nixos
   mount -o bind /mnt/nix/persist/etc/nixos /mnt/etc/nixos

4. Generate a basic configuration:

   nixos-generate-config --root /mnt

5. Clone the repository locally:

   nix-shell -p git
   git clone  https://github.com/storopoli/flakes.git /mnt/etc/nixos/flakes
   cd /mnt/etc/nixos/flakes/
   nix develop --extra-experimental-features nix-command --extra-experimental-features flakes

6. Copy hardware-configuration.nix from /mnt/etc/nixos to /mnt/etc/nixos/flakes/hosts/laptop/hardware-configuration.nix:

   cp /mnt/etc/nixos/hardware-configuration.nix /mnt/etc/nixos/flakes/hosts/laptop/hardware-configuration.nix

7. Modify the overwritten hardware-configuration.nix:

   nvim /mnt/etc/nixos/flakes/hosts/laptop/hardware-configuration.nix

   ...
   # This is just an example
   # Please refer to `https://elis.nu/blog/2020/05/nixos-tmpfs-as-root/#step-4-1-configure-disks`
   
     fileSystems."/" =
       { device = "none";
         fsType = "tmpfs";
         options = [ "defaults" "size=12G" "mode=755"  ];
       };
   
     fileSystems."/nix" =
       { device = "/dev/disk/by-uuid/49e24551-c0e0-48ed-833d-da8289d79cdd";
         fsType = "ext4";
       };
   
     fileSystems."/boot" =
       { device = "/dev/disk/by-uuid/3C0D-7D32";
         fsType = "vfat";
       };
   
     fileSystems."/etc/nixos" =
       { device = "/nix/persist/etc/nixos";
         fsType = "none";
         options = [ "bind" ];
       };
   ...

8. remove /mnt/etc/nixos/flakes/.git:

   rm -rf .git

9. Username modification: edit /mnt/etc/nixos/flakes/flake.nix to modify user variable, hostname modification: edit /mnt/etc/nixos/flakes/hosts/system.nix to modify the hostName value in the networking property group

10. Use the hash password generated by the mkpasswd {PASSWORD} -m sha-512 command to replace the value of users.users.<name>.hashedPassword in /mnt/etc/nixos/flakes/hosts/laptop/wayland/default.nix (there is two place needs to be displace)

11. Select Window Manager:

    • Hyprland (the default): uncomment this line and this line, comment this line and this line

    • Sway: uncomment this line and this line, comment this line and this line

12. Select a theme here choose the one you want:

    • [catppuccin-dark]
    • [catppuccin-light]
    • [nord]

13. Perform install:

    nixos-install --no-root-passwd --flake .#laptop

14. Reboot

    reboot

15. Enjoy it!

How to Update

1. First, update the input in flake:

   # update the specified input
   nix flake lock --update-input <foo> <foo>
   # or,update all inputs
   nix flake update

2. Then, rebuild and switch to the system after rebuild:

   doas nixos-rebuild --flake .#<hostname>