Repo that has the configuration for a nice NixOS setup using nixos-unstable and Hyprland. Most of the config here is for my Framework 13 with an AMD Ryzen 5 7640U, so some things may need to be changed in your case!
-
Make and boot an unstable (or stable, but preferably unstable) NixOS Minimal installer USB
-
Connect to internet (WiFi or Ethernet)
-
Install Git (we'll use nix-env as this is just an installer)
nix-env -iA nixos.gitMinimal -
Get this flake onto installer (use git or copy from USB drive) and then use
cdto enter into that directory -
Examine the configuration file for your machine, and add in proper device path for the drive you would like to install to, along with setting what size you want the swapfile in the disko configuration file (if you want a swap size other than 20GB, which should be optimal for 16GB of RAM with hibernation). Check anything with
FIXME:and follow it's directions! -
!!THIS WILL ERASE YOUR DRIVE!! Run the following command to partition disk using the disko configuration:
sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko -- --mode disko disko/carbon-disko.nix -
Proceed to install NixOS with
sudo nixos-install --flake .#carbon -
After completion of install, reboot into the SSD you installed to.
-
Log in using username and initialPassword set in configuration through GDM.
-
Change password with
passwd -
You should be good! All done!!
Secure boot on NixOS using Lanzaboote, it's not that hard! Start by running nix-shell -p sbctl --command "sudo sbctl create-keys" to generate your secure boot keys! Proceed to follow the instructions from Lanzaboote.
The disko config provided by carbon-disko.nix includes full disk encryption that will prompt you for an encryption password when you format the drive, and using it like that will work totally fine! The fun thing is, carbon is also configured for automatic decryption of the drive thanks to TPM2 and systemd-cryptenroll. To enable automatic decryption of your drive at boot using the TPM2 chip in your device, simply run sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+4+7 /dev/nvme0n1p2 if you have secure boot, or run sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+4 /dev/nvme0n1p2 if you do not! It will prompt you for your drive password, and then will automatically decrypt at boot. Note, there are security implications of doing this, anyone with physical access to your computer could boot it without any user login!