Enable disk encryption of persistent partitions
diff --git a/modules/filesystems.nix b/modules/filesystems.nix
index eaadfde..73ef7e1 100644
--- a/modules/filesystems.nix
+++ b/modules/filesystems.nix
@@ -20,12 +20,17 @@
};
fileSystems."/nix" = {
- device = "/dev/disk/by-label/nixos";
+ device = "/dev/mapper/nix";
+ fsType = "ext4";
+ };
+
+ fileSystems."/large" = {
+ device = "/dev/mapper/hdd";
fsType = "ext4";
};
swapDevices = [
- {device = "/dev/disk/by-label/swap";}
+ {device = "/dev/mapper/swap";}
];
};
}
diff --git a/modules/nix.nix b/modules/nix.nix
index 83954ce..4c432b0 100644
--- a/modules/nix.nix
+++ b/modules/nix.nix
@@ -1,10 +1,12 @@
{
pkgs,
registry,
+ nixpkgs,
...
}: {
config = {
nix = {
+ registry.nixpkgs.flake = nixpkgs;
settings = {
experimental-features = ["nix-command" "flakes"];
auto-optimise-store = true;
diff --git a/modules/security.nix b/modules/security.nix
index d7bdbda..75ab2be 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -1,6 +1,18 @@
{
- config.security.apparmor = {
- enable = true;
- killUnconfinedConfinables = true;
+ config = {
+ security.apparmor = {
+ enable = true;
+ killUnconfinedConfinables = true;
+ };
+
+ boot.initrd.availableKernelModules = [
+ "aesni_intel"
+ "cryptd"
+ ];
+
+ boot.initrd.luks.devices = {
+ nix.device = "/dev/disk/by-label/nix";
+ swap.device = "/dev/disk/by-label/swap";
+ hdd.device = "/dev/disk/by-label/hdd";
};
}