30 lines
667 B
Nix
30 lines
667 B
Nix
{ config, pkgs, ... }: {
|
|
boot.loader.systemd-boot = {
|
|
enable = true;
|
|
configurationLimit = 5;
|
|
};
|
|
|
|
fileSystems."/boot" = {
|
|
device = "/dev/disk/by-label/boot";
|
|
fsType = "vfat";
|
|
};
|
|
|
|
boot.initrd.luks.devices.root = {
|
|
device = "/dev/disk/by-label/root";
|
|
|
|
# WARNING: Leaks some metadata, see cryptsetup man page for --allow-discards.
|
|
allowDiscards = true;
|
|
|
|
# Set your own key with:
|
|
# cryptsetup luksChangeKey /dev/disk/by-label/root --key-file=/dev/zero --keyfile-size=1
|
|
# You can then delete the rest of this block.
|
|
keyFile = "/dev/zero";
|
|
keyFileSize = 1;
|
|
};
|
|
|
|
fileSystems."/" = {
|
|
device = "/dev/mapper/root";
|
|
fsType = "ext4";
|
|
};
|
|
}
|