Greetings.
I’ve recently tried working on my own portable nix setup and am a little confused what boot.initrd.luks.devices."redacted idk if this is actually a secret".device = “/dev/disk/by-uuid/redacted_again”; exactly does. I am assuming that it is necessary with my main disk being encrypted. My question is as following: How do I edit my hardware-config.nix to allow drives other than that specific UUID to be able to be decrypted on start? I plan to use this on multiple computers and they will all (I presume) have different UUIDs for their main disk. Additionally, unless it’s absolutely necessary, I would prefer to not use a tool like disko that (looks like) it formats the primary drive to match expected criteria.
Is this possible to do?
You can replace
with /dev/disk/by-partlabel/label. Then you can give all the LUKS partitions the same partition label.
filesystems."/" also needs to refer to /dev/mapper/ not /dev/disk/.
4 Likes
The default generated config for NixOS assumes that configuration.nix will be shared/copied between computers, and hardware-configuration.nix will be unique to each machine, hence having reference to drive UUIDs.
To have a portable partition config you can either reference drives by label manually as @MaxHearnden suggested, or have disko reference drives by label for you. Beware: this opens you up to issues where drives you plug in from other machines with the same label (e.g. you’re recovering a bricked machine) can be confused with your primary devices, but is generally ok if you plug those devices in AFTER boot, and map/mount them manually.
disko does not force you to use it to format your drives, it simply provides an module structure that can be used to both partition on install, and subsequently mount all the partitioned drives. If you do use it, it makes setting up additional machines with nixos-anywhere super easy.
1 Like
(To be clear, this is a concern with UUIDs too. In terms of where the UUID comes from on disk and whether the OS will give it the corresponding symlinks in /dev/disk/by-(part)uuid, UUIDs are completely identical in functionality to labels. So the only reason UUIDs are preferable in this way is because they’re not going to clash when two different partitions / file systems were independently generated with random UUIDs. From a security perspective, this pretty much makes UUIDs worthless though; you cannot trust a device to be the one you intend just because it has the right UUID.)
I don’t disagree. My point is more that it’s super very annoying to attach the drive from a borked machine to a working one and have it stop the working machine from booting. Ask me how I know.