refactor: migrate idols-ai to new ssd (#247)

* refactor: migrate idols-ai to new ssd * fix: github repo mi2ebi/tree-sitter-bovex 404 • Updated input 'helix': 'github:mattwparas/helix/908d48c5dd9700ddff65bcfce8850eea74af0360?narHash=sha256-hXxc3JqZ%2BxF2VjTOczmYHVttRIWlxGh5RmYZ9OcMPD8%3D' (2026-02-15) → 'github:mattwparas/helix/bb5efb6ec09792a91dc6b4dec1a4d6534b7185dc?narHash=sha256-FfbsMeo8p0JUUCf4TnYu5G35vVkFSuqh%2BEHXHyV1/UI%3D' (2026-03-13) * chore: disable helix * fix: failed to mount swapfile
2026-07-15 17:13:21 +02:00 · 2026-03-16 10:07:08 +08:00
parent 850a7b2c43
commit a5295500f1
9 changed files with 337 additions and 403 deletions
@@ -0,0 +1,128 @@
+# Disko layout for idols-ai on nvme1n1 (target disk after migration).
+# Same structure as current nvme0n1: ESP + LUKS + btrfs with ephemeral root (tmpfs).
+#
+# Format & mount (from installer or live system):
+#   nix run github:nix-community/disko -- --mode disko ./disko-fs.nix
+# Mount only (after first format):
+#   nix run github:nix-community/disko -- --mode mount ./disko-fs.nix
+#
+# Use by-id for stability; override device when installing, e.g.:
+#   nixos-install --flake .#ai --option disko.devices.disk.nixos-ai.device /dev/nvme1n1
+{
+  # Ephemeral root; preservation mounts /persistent for state.
+  fileSystems."/persistent".neededForBoot = true;
+
+  disko.devices = {
+    # Ephemeral root; relatime and mode=755 so systemd does not set 777.
+    nodev."/" = {
+      fsType = "tmpfs";
+      mountOptions = [
+        "relatime" # Update inode access times relative to modify/change time
+        "mode=755"
+      ];
+    };
+
+    disk.nixos-ai = {
+      type = "disk";
+      # Override at install time if needed: --option disko.devices.disk.nixos-ai.device /dev/nvme1n1
+      device = "/dev/nvme1n1";
+      content = {
+        type = "gpt";
+        partitions = {
+          # EFI system partition; must stay unencrypted for UEFI to load the bootloader.
+          ESP = {
+            priority = 1;
+            name = "ESP";
+            start = "1M";
+            end = "600M";
+            type = "EF00"; # EF00 = ESP in GPT
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+              mountOptions = [
+                "fmask=0177" # File mask: 777-177=600 (owner rw-, group/others ---)
+                "dmask=0077" # Directory mask: 777-077=700 (owner rwx, group/others ---)
+                "noexec,nosuid,nodev" # Security: no execution, ignore setuid, no device nodes
+              ];
+            };
+          };
+          # Root partition: LUKS encrypted, then btrfs with subvolumes.
+          root = {
+            size = "100%";
+            content = {
+              type = "luks";
+              name = "nixos-luks"; # Mapper name; match boot.initrd.luks
+              settings = {
+                allowDiscards = true; # TRIM for SSDs; slightly less secure, better performance
+              };
+              # Add boot.initrd.luks.devices so initrd prompts for passphrase at boot
+              initrdUnlock = true;
+              # cryptsetup luksFormat options
+              extraFormatArgs = [
+                "--type luks2"
+                "--cipher aes-xts-plain64"
+                "--hash sha512"
+                "--iter-time 5000"
+                "--key-size 256"
+                "--pbkdf argon2id"
+                "--use-random" # Block until enough entropy from /dev/random
+              ];
+              extraOpenArgs = [
+                "--timeout 10"
+              ];
+              content = {
+                type = "btrfs";
+                extraArgs = [ "-f" ]; # Force overwrite if filesystem already exists
+                subvolumes = {
+                  # Top-level subvolume (id 5); used for btrfs send/receive and snapshots
+                  "/" = {
+                    mountpoint = "/btr_pool";
+                    mountOptions = [ "subvolid=5" ];
+                  };
+                  "@nix" = {
+                    mountpoint = "/nix";
+                    mountOptions = [
+                      "compress-force=zstd:1" # Save space and reduce I/O on SSD
+                      "noatime"
+                    ];
+                  };
+                  "@guix" = {
+                    mountpoint = "/gnu";
+                    mountOptions = [
+                      "compress-force=zstd:1"
+                      "noatime"
+                    ];
+                  };
+                  "@persistent" = {
+                    mountpoint = "/persistent";
+                    mountOptions = [
+                      "compress-force=zstd:1"
+                    ];
+                  };
+                  "@snapshots" = {
+                    mountpoint = "/snapshots";
+                    mountOptions = [
+                      "compress-force=zstd:1"
+                    ];
+                  };
+                  "@tmp" = {
+                    mountpoint = "/tmp";
+                    mountOptions = [
+                      "compress-force=zstd:1"
+                    ];
+                  };
+                  # Swap subvolume read-only; disko creates swapfile and adds swapDevices
+                  "@swap" = {
+                    mountpoint = "/swap";
+                    swap.swapfile.size = "20G";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}