use systemd initrd

Signed-off-by: Yǔchēn Guō 郭宇琛 <yguo@posteo.net>

README.org

@@ -1,24 +1,18 @@
-* Minimal NixOS Root on ZFS configuration
-This repo contains a minimal set of configuration needed for
-installing NixOS on a computer with ZFS as root filesystem.
+* Install NixOS with ZFS as root filesystem
+This repo contains a minimal set of configuration for installing
+NixOS, using ZFS as root filesystem.
 
-#+begin_src text
-.gitignore
-LICENSE
-configuration.nix   <- configuration shared by all hosts
-flake.lock
-flake.nix
-hosts/exampleHost/default.nix  <- per-host configuration
-hosts/exampleHost/sshUnlock.txt
-modules/boot/default.nix
-modules/default.nix
-modules/fileSystems/default.nix
-modules/networking/default.nix
-modules/users/default.nix
-#+end_src
+ZFS is a modern filesystem with many features such as snapshot,
+self-healing and pooled storage, see [[https://openzfs.org/wiki/Main_Page#Introduction_to_OpenZFS][Introduction]] for details.
 
-Just enough to get you started.
+For using this repo on your computer, see [[https://openzfs.github.io/openzfs-docs/Getting%20Started/NixOS/Root%20on%20ZFS.html][Documentation]].
 
-See [[https://github.com/ne9z/personal-dotfiles][my personal dotfiles repo]] for an example of how to configure
-servers and desktop computers in the same git repository, based on
-this template repo you are viewing now.
+Upon initial installation, only the bootloader, mountpoints and root
+password are configured.
+
+- Refer to =man configuration.nix= for available options;
+- Search for available packages with [[https://search.nixos.org/packages][Package Search]];
+- Search for options with [[https://search.nixos.org/options][Option Search]].
+
+[[https://codeberg.org/m0p/dotfiles][My personal dotfiles repo]] contains an example of desktop configuration
+based on sway, tmux and Emacs.

configuration.nix

@@ -1,16 +1,8 @@
-{ my-config, zfs-root, inputs, pkgs, lib, ... }: {
-  # load module config to top-level configuration
-  inherit my-config zfs-root;
-
-  # Let 'nixos-version --json' know about the Git revision
-  # of this flake.
-  system.configurationRevision = if (inputs.self ? rev) then
-    inputs.self.rev
-  else
-    throw "refuse to build: git tree is dirty";
-
-  system.stateVersion = "22.11";
+# configuration in this file is shared by all hosts
 
+{ pkgs, pkgs-unstable, inputs, ... }:
+let inherit (inputs) self;
+in {
   # Enable NetworkManager for wireless networking,
   # You can configure networking with "nmtui" command.
   networking.useDHCP = true;
@@ -23,31 +15,48 @@
     };
   };
 
+  ## enable GNOME desktop.
+  ## You need to configure a normal, non-root user.
+  # services.xserver = {
+  #  enable = true;
+  #  desktopManager.gnome.enable = true;
+  #  displayManager.gdm.enable = true;
+  # };
+
+  ## enable ZFS auto snapshot on datasets
+  ## You need to set the auto snapshot property to "true"
+  ## on datasets for this to work, such as
+  # zfs set com.sun:auto-snapshot=true rpool/nixos/home
+  services.zfs = {
+    autoSnapshot = {
+      enable = false;
+      flags = "-k -p --utc";
+      monthly = 48;
+    };
+  };
+
   programs.neovim = {
     enable = true;
     viAlias = true;
     vimAlias = true;
   };
 
-  imports = [
-    "${inputs.nixpkgs}/nixos/modules/installer/scan/not-detected.nix"
-    # "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
-  ];
-
   services.openssh = {
-    enable = lib.mkDefault true;
-    settings = { PasswordAuthentication = lib.mkDefault false; };
+    enable = true;
+    settings = { PasswordAuthentication = false; };
   };
 
-  boot.zfs.forceImportRoot = lib.mkDefault false;
+  boot.zfs.forceImportRoot = false;
 
-  nix.settings.experimental-features = lib.mkDefault [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  boot.initrd.systemd.enable = true;
 
   programs.git.enable = true;
 
   security = {
-    doas.enable = lib.mkDefault true;
-    sudo.enable = lib.mkDefault false;
+    doas.enable = true;
+    sudo.enable = false;
   };
 
   environment.systemPackages = builtins.attrValues {
@@ -55,5 +64,27 @@
       mg # emacs-like editor
       jq # other programs
     ;
+    # By default, the system will only use packages from the
+    # stable channel. i.e.
+    # inherit (pkg) my-favorite-stable-package;
+    # You can selectively install packages
+    # from the unstable channel. Such as
+    # inherit (pkgs-unstable) my-favorite-unstable-package;
+    # You can also add more
+    # channels to pin package version.
   };
+
+  # Safety mechanism: refuse to build unless everything is
+  # tracked by git
+  system.configurationRevision = if (self ? rev) then
+    self.rev
+  else
+    throw "refuse to build: git tree is dirty";
+
+  system.stateVersion = "23.05";
+
+  # let nix commands follow system nixpkgs revision
+  nix.registry.nixpkgs.flake = inputs.nixpkgs;
+  # you can then test any package in a nix shell, such as
+  # $ nix shell nixpkgs#neovim
 }

flake.lock

@@ -1,24 +1,61 @@
 {
   "nodes": {
-    "nixpkgs": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1685533922,
-        "narHash": "sha256-y4FCQpYafMQ42l1V+NUrMel9RtFtZo59PzdzflKR/lo=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "3a70dd92993182f8e514700ccf5b1ae9fc8a3b8d",
+        "lastModified": 1695108154,
+        "narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "07682fff75d41f18327a871088d20af2710d4744",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-23.05",
-        "repo": "nixpkgs",
+        "owner": "nix-community",
+        "ref": "release-23.05",
+        "repo": "home-manager",
         "type": "github"
       }
     },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1696983906,
+        "narHash": "sha256-L7GyeErguS7Pg4h8nK0wGlcUTbfUMDu+HMf1UcyP72k=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bd1cde45c77891214131cbbea5b1203e485a9d51",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-23.05",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1697349934,
+        "narHash": "sha256-mSOXTIvCMA31nD/XEYmeSOebrXl0lFKirM14LK845e4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "f320b0d46ee33f521f50d7c6885605714210e5c9",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "master",
+        "type": "indirect"
+      }
+    },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable"
       }
     }
   },

flake.nix

@@ -1,27 +1,61 @@
 {
-  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05";
-  ## after reboot, you can track rolling release by using
-  #inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+  description = "Barebones NixOS on ZFS config";
 
-  outputs = { self, nixpkgs }@inputs:
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-23.05";
+    nixpkgs-unstable.url = "nixpkgs/master";
+    home-manager = {
+      url = "github:nix-community/home-manager/release-23.05";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, nixpkgs-unstable, home-manager }@inputs:
     let
-      lib = nixpkgs.lib;
-      mkHost = { my-config, zfs-root, pkgs, system, ... }:
-        lib.nixosSystem {
-          inherit system;
+      mkHost = hostName: system:
+        nixpkgs.lib.nixosSystem {
+          pkgs = import nixpkgs {
+            inherit system;
+            # settings to nixpkgs goes to here
+            # nixpkgs.pkgs.zathura.useMupdf = true;
+            # nixpkgs.config.allowUnfree = false;
+          };
+
+          specialArgs = {
+            # By default, the system will only use packages from the
+            # stable channel.  You can selectively install packages
+            # from the unstable channel.  You can also add more
+            # channels to pin package version.
+            pkgs-unstable = import nixpkgs-unstable {
+              inherit system;
+              # settings to nixpkgs-unstable goes to here
+            };
+
+            # make all inputs availabe in other nix files
+            inherit inputs;
+          };
+
           modules = [
+            # Root on ZFS related configuration
             ./modules
-            (import ./configuration.nix {
-              inherit my-config zfs-root inputs pkgs lib;
-            })
+
+            # Configuration shared by all hosts
+            ./configuration.nix
+
+            # Configuration per host
+            ./hosts/${hostName}
+
+            # home-manager
+            home-manager.nixosModules.home-manager
+            {
+              home-manager.useGlobalPkgs = true;
+              home-manager.useUserPackages = true;
+            }
           ];
         };
     in {
       nixosConfigurations = {
-        exampleHost = let
-          system = "x86_64-linux";
-          pkgs = nixpkgs.legacyPackages.${system};
-        in mkHost (import ./hosts/exampleHost { inherit system pkgs; });
+        exampleHost = mkHost "exampleHost" "x86_64-linux";
       };
     };
 }

hosts/exampleHost/changeHostName.txt

@@ -1,45 +1,39 @@
 How to set hostname for a host.
 
-This repo is structured in a way that allows managing multiple hosts
-in a single repo.  As a consequence of this, hostname appears in
-several different places and should be updated together if needed.
+You need to change the host name in three different places.
 
-The entry point of this repo is ``flake.nix'' file, which takes a
-revision of the nixpkgs as input then gives an attribute set (attrset)
-as output:
+Place 1.
 
-  {
-    nixosConfigurations = {
-      exampleHost = { ... };
-      host2 = { ... };
-      host3 = { ... };
-      ...
-    };
-  }
+./flake.nix
 
+Change
 
-The hostname specified here inside nixosConfigurations attrset is used
-when ``nix command'' is invoked, as in
+    exampleHost = mkHost "exampleHost" "x86_64-linux";
 
-  nixos-install --flake ./#exampleHost
+to
 
-The hostname also appears in the filesystem path of the per-host
-configuration file:
+    myHost = mkHost "myHost" "x86_64-linux";
 
-  hosts/exampleHost/default.nix
-  hosts/host2/default.nix
-  ...
+Place 2.
 
-Finally, the hostname is specified in the zfs-boot.networking.hostName
-option inside per-host configuration file at
-hosts/exampleHost/default.nix:
+Move directory
 
-  zfs-boot.networking.hostName = "exampleHost";
+    ./hosts/exampleHost
 
-If the value of this option is identical to the name of
-nixosConfigurations.<hostname> attrset, all subsequent invocations of
-``nix command'' will default to this hostname, i.e. the command:
+to
 
-  nixos-rebuild boot
+    ./hosts/myHost
 
-will automatically append ``#hostName'' when evaluating the flake.
+Place 3.
+
+./hosts/exampleHost/default.nix
+
+Change
+
+  networking.hostName = "exampleHost";
+
+to
+
+  networking.hostName = "myHost";
+
+End.

hosts/exampleHost/default.nix

@@ -1,37 +1,24 @@
-# #
-##
-##  per-host configuration for exampleHost
-##
-##
-
-{ system, pkgs, ... }: {
-  inherit pkgs system;
+{ config, pkgs, lib, inputs, modulesPath, ... }: {
   zfs-root = {
     boot = {
       devNodes = "/dev/disk/by-id/";
       bootDevices = [ "bootDevices_placeholder" ];
-      immutable = false;
-      availableKernelModules = [ "kernelModules_placeholder" ];
+      immutable.enable = false;
       removableEfi = true;
-      kernelParams = [ ];
-      sshUnlock = {
-        # read sshUnlock.txt file.
-        enable = false;
-        authorizedKeys = [ ];
-      };
-    };
-    networking = {
-      # read changeHostName.txt file.
-      hostName = "exampleHost";
-      timeZone = "Europe/Berlin";
-      hostId = "abcd1234";
+      luks.enable = false;
     };
   };
+  boot.initrd.availableKernelModules = [ "kernelModules_placeholder" ];
+  boot.kernelParams = [ ];
+  networking.hostId = "abcd1234";
+  # read changeHostName.txt file.
+  networking.hostName = "exampleHost";
+  time.timeZone = "Europe/Berlin";
 
-  # To add more options to per-host configuration, you can create a
-  # custom configuration module, then add it here.
-  my-config = {
-    # Enable custom gnome desktop on exampleHost
-    template.desktop.gnome.enable = false;
-  };
+  # import preconfigured profiles
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    # (modulesPath + "/profiles/hardened.nix")
+    # (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 }

hosts/exampleHost/sshUnlock.txt

@@ -1,61 +0,0 @@
-Audience
-
-This text is intended for users who wish to remotely unlock their
-natively encrypted ZFS root filesystem with SSH during the early
-stages of system boot up.
-
-=================================================================
-
-Steps
-
-By default, the initial RAM disk image, (hereafter refered to as
-initrd) only includes essential kernel modules needed for mounting the
-root filesystem.
-
-To enable network connection during this stage of system boot, you
-need to instruct NixOS to include kernel modules needed for the
-network adapter.
-
-Check which module is needed with:
-
-  nix-shell -p pciutils --run "lspci -v | grep -iA8 'network\|ethernet'"
-
-Then, add the the modules to
-
-  zfs-root.boot.availableKernelModules
-
-option inside the per-host configuration file.  This file is located
-at hosts/exampleHost/default.nix.
-
-By default, initrd uses DHCP auto-configuration for networking.  If
-you need to specify a static IP address, see the documentation for
-"ip=" kernel command line option for NFS root:
-
-  https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
-
-Then, add the necessary kernel command line options to
-
-  zfs-root.boot.kernelParams
-
-option inside the per-host configuration file.
-
-Finally, you need to generate a pair of SSH private keys exclusively
-for use with decrypting the root filesystem during boot.  This pair of
-keys should not be used anywhere else.  Reasons for this can be found
-in the documentation NixOS option:
-
-  boot.initrd.network.ssh.hostKeys
-
-> Do NOT use your regular SSH host private keys for this purpose or
-> you'll expose them to regular users! Additionally, even if your initrd
-> supports secrets, if you're using initrd SSH to unlock an encrypted
-> disk then using your regular host keys exposes the private keys on
-> your unencrypted boot partition.
-
-You can generate host key with:
-
-  ssh-keygen -t ed25519 -N "" -f "/var/lib/ssh_unlock_zfs_ed25519_key"
-  ssh-keygen -t rsa -N "" -f "/var/lib/ssh_unlock_zfs_rsa_key"
-
-If you are performing a system installation, change path from
-/var/lib to /mnt/var/lib in both commands.

modules/boot/default.nix

@@ -11,6 +11,11 @@ in {
       type = types.bool;
       default = true;
     };
+    luks.enable = mkOption {
+      description = "Use luks encryption";
+      type = types.bool;
+      default = false;
+    };
     devNodes = mkOption {
       description = "Specify where to discover ZFS pools";
       type = types.str;
@@ -24,15 +29,7 @@ in {
       description = "Specify boot devices";
       type = types.nonEmptyListOf types.str;
     };
-    availableKernelModules = mkOption {
-      type = types.nonEmptyListOf types.str;
-      default = [ "uas" "nvme" "ahci" ];
-    };
-    kernelParams = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-    };
-    immutable = mkOption {
+    immutable.enable = mkOption {
       description = "Enable root on ZFS immutable root support";
       type = types.bool;
       default = false;
@@ -53,47 +50,52 @@ in {
       description = "Describe on disk partitions";
       type = types.attrsOf types.str;
     };
-    sshUnlock = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      authorizedKeys = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-      };
-    };
   };
   config = mkIf (cfg.enable) (mkMerge [
     {
       zfs-root.fileSystems.datasets = {
+        # rpool/path/to/dataset = "/path/to/mountpoint"
         "rpool/nixos/home" = mkDefault "/home";
         "rpool/nixos/var/lib" = mkDefault "/var/lib";
         "rpool/nixos/var/log" = mkDefault "/var/log";
         "bpool/nixos/root" = "/boot";
       };
     }
-    (mkIf (!cfg.immutable) {
+    (mkIf cfg.luks.enable {
+      boot.initrd.luks.devices = mkMerge (map (diskName: {
+        "luks-rpool-${diskName}${cfg.partitionScheme.rootPool}" = {
+          device = (cfg.devNodes + diskName + cfg.partitionScheme.rootPool);
+          allowDiscards = true;
+          bypassWorkqueues = true;
+        };
+      }) cfg.bootDevices);
+    })
+    (mkIf (!cfg.immutable.enable) {
       zfs-root.fileSystems.datasets = { "rpool/nixos/root" = "/"; };
     })
-    (mkIf cfg.immutable {
+    (mkIf cfg.immutable.enable {
       zfs-root.fileSystems = {
         datasets = {
+          # rpool/path/to/dataset = "/path/to/mountpoint"
           "rpool/nixos/empty" = "/";
           "rpool/nixos/root" = "/oldroot";
         };
         bindmounts = {
+          # /bindmount/source = /bindmount/target
           "/oldroot/nix" = "/nix";
           "/oldroot/etc/nixos" = "/etc/nixos";
         };
       };
-      boot.initrd.postDeviceCommands = ''
-        if ! grep -q zfs_no_rollback /proc/cmdline; then
-          zpool import -N rpool
-          zfs rollback -r rpool/nixos/empty@start
-          zpool export -a
-        fi
-      '';
+      boot.initrd.systemd.services.immutable-zfs-root = {
+        description = "Rollback root filesystem to an empty snapshot";
+        unitConfig.DefaultDependencies = false;
+        wantedBy = [ "zfs.target" ];
+        after = [ "zfs-import-rpool.service" ];
+        before = [ "sysroot.mount" ];
+        path = [ pkgs.zfs ];
+        serviceConfig.Type = "oneshot";
+        script = "zfs rollback -r rpool/nixos/empty@start";
+      };
     })
     {
       zfs-root.fileSystems = {
@@ -104,10 +106,6 @@ in {
           (map (diskName: diskName + cfg.partitionScheme.swap) cfg.bootDevices);
       };
       boot = {
-        kernelPackages =
-          mkDefault config.boot.zfs.package.latestCompatibleLinuxPackages;
-        initrd.availableKernelModules = cfg.availableKernelModules;
-        kernelParams = cfg.kernelParams;
         supportedFilesystems = [ "zfs" ];
         zfs = {
           devNodes = cfg.devNodes;
@@ -136,27 +134,5 @@ in {
         };
       };
     }
-    (mkIf cfg.sshUnlock.enable {
-      boot.initrd = {
-        network = {
-          enable = true;
-          ssh = {
-            enable = true;
-            hostKeys = [
-              "/var/lib/ssh_unlock_zfs_ed25519_key"
-              "/var/lib/ssh_unlock_zfs_rsa_key"
-            ];
-            authorizedKeys = cfg.sshUnlock.authorizedKeys;
-          };
-          postCommands = ''
-            tee -a /root/.profile >/dev/null <<EOF
-            if zfs load-key rpool/nixos; then
-               pkill zfs
-            fi
-            exit
-            EOF'';
-        };
-      };
-    })
   ]);
 }

modules/default.nix

@@ -1,3 +1 @@
-{ config, lib, pkgs, ... }: {
-  imports = [ ./boot ./fileSystems ./networking ./my-config ];
-}
+{ config, lib, pkgs, ... }: { imports = [ ./boot ./fileSystems ]; }

modules/fileSystems/default.nix

@@ -41,7 +41,7 @@ in {
     };
   }) cfg.bindmounts ++ map (esp: {
     "/boot/efis/${esp}" = {
-      device = "${config.zfs-root.boot.devNodes}/${esp}";
+      device = "${config.zfs-root.boot.devNodes}${esp}";
       fsType = "vfat";
       options = [
         "x-systemd.idle-timeout=1min"
@@ -54,7 +54,7 @@ in {
     };
   }) cfg.efiSystemPartitions);
   config.swapDevices = mkDefault (map (swap: {
-    device = "${config.zfs-root.boot.devNodes}/${swap}";
+    device = "${config.zfs-root.boot.devNodes}${swap}";
     discardPolicy = mkDefault "both";
     randomEncryption = {
       enable = true;

modules/my-config/default.nix

@@ -1,41 +0,0 @@
-{ config, lib, pkgs, ... }:
-let inherit (lib) types mkIf mkDefault mkOption;
-in {
-  options.my-config = {
-    template.desktop.gnome.enable = mkOption {
-      description = "Enable my customized GNOME desktop";
-      type = types.bool;
-      default = false;
-    };
-  };
-
-  # if my-config.template.desktop.gnome.enable is set to true
-  # set the following options
-  config = mkIf config.my-config.template.desktop.gnome.enable {
-    services.xserver = {
-      enable = true;
-      desktopManager.gnome.enable = true;
-      displayManager.gdm.enable = true;
-    };
-
-    # GNOME must be used with a non-root user,
-    # add a non-root user
-    users.users.alice = {
-      # Generate hashed password with "mkpasswd -m sha-512" command,
-      # "!" disables login.
-      # "mkpasswd" without "-m sha-512" will not work
-      initialHashedPassword = "!";
-      description = "Full Name";
-      # Users in "wheel" group are allowed to use "doas" command
-      # to obtain root permissions.
-      extraGroups = [ "wheel" ];
-      packages = builtins.attrValues {
-        inherit (pkgs)
-          mg # emacs-like editor
-          jq # other programs
-        ;
-      };
-      isNormalUser = true;
-    };
-  };
-}

modules/networking/default.nix

@@ -1,29 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.zfs-root.networking;
-  inherit (lib) types mkDefault mkOption;
-in {
-  options.zfs-root.networking = {
-    hostName = mkOption {
-      description = "The name of the machine.  Used by nix flake.";
-      type = types.str;
-      default = "exampleHost";
-    };
-    timeZone = mkOption {
-      type = types.str;
-      default = "Etc/UTC";
-    };
-    hostId = mkOption {
-      description = "Set host id";
-      type = types.str;
-    };
-  };
-  config = {
-    networking.hostId = cfg.hostId;
-    time.timeZone = cfg.timeZone;
-    networking = {
-      firewall.enable = mkDefault true;
-      hostName = cfg.hostName;
-    };
-  };
-}