feat: idols-ai - add new data disk via disko (#250)

feat: luks automatic unlock via tpm2 chip for all physical hosts
feat: enable login manager
fix: Rename network interface config back following hardware change

hosts/idols-ai/README.md

@@ -6,7 +6,10 @@ Desktop (NixOS + preservation, LUKS + btrfs on nvme). Disk layout is declarative
 Related:
 
 - [nixos-installer README](/nixos-installer/README.md) – install from ISO using disko
-- [disko-fs.nix](./disko-fs.nix) – partition/layout definition (ESP + LUKS + btrfs)
+- [disko-fs.nix](./disko-fs.nix) – main disk layout (ESP + LUKS + btrfs). From
+  `nix-config/nixos-installer`:  
+  `nix run github:nix-community/disko -- --mode destroy,format,mount ../hosts/idols-ai/disko-fs.nix`
+- [disko-fs-media.nix](./disko-fs-media.nix) – media disk layout (LUKS + btrfs at /persistent/media)
 
 ## TODOs
 

hosts/idols-ai/default.nix

@@ -20,8 +20,11 @@ in
 {
   imports = [
     disko.nixosModules.default
+    # disks
     ./disko-fs.nix
+    ./disko-fs-data.nix
     ./netdev-mount.nix
+
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
     ./nvidia.nix

hosts/idols-ai/disko-fs-data.nix

@@ -0,0 +1,62 @@
+# Disko layout for idols-ai data disk (LUKS + btrfs, mount at /persistent/data).
+#
+# Destroy, format & mount (wipes disk; from nixos-installer: cd nix-config/nixos-installer):
+#   nix run github:nix-community/disko -- --mode destroy,format,mount ../hosts/idols-ai/disko-fs-data.nix
+# Mount only (after first format):
+#   nix run github:nix-community/disko -- --mode mount ../hosts/idols-ai/disko-fs-data.nix
+#
+{
+  disko.devices = {
+    disk.data = {
+      type = "disk";
+      device = "/dev/disk/by-id/nvme-Fanxiang_S790_2TB_FXS790254050582";
+      content = {
+        type = "gpt";
+        partitions = {
+          datapart = {
+            size = "100%";
+            content = {
+              type = "luks";
+              name = "data-luks"; # Mapper name; match boot.initrd.luks
+              settings = {
+                allowDiscards = true; # TRIM for SSDs; slightly less secure, better performance
+              };
+              # Add boot.initrd.luks.devices so initrd prompts for passphrase at boot
+              initrdUnlock = true;
+              # cryptsetup luksFormat options
+              extraFormatArgs = [
+                "--type luks2"
+                "--cipher aes-xts-plain64"
+                "--hash sha512"
+                "--iter-time 5000"
+                "--key-size 256"
+                "--pbkdf argon2id"
+                "--use-random" # Block until enough entropy from /dev/random
+              ];
+              extraOpenArgs = [
+                "--timeout 10"
+              ];
+              content = {
+                type = "btrfs";
+                extraArgs = [ "-f" ]; # Force overwrite if filesystem already exists
+                subvolumes = {
+                  "@data" = {
+                    mountpoint = "/data";
+                    mountOptions = [
+                      "compress-force=zstd:1"
+                    ];
+                  };
+                };
+                postMountHook = ''
+                  chown ryan:users /mnt/data
+                  # Set SGID + rwx for owner/group, read-only for others; new files inherit group
+                  chmod 2755 /mnt/data
+                '';
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/idols-ai/disko-fs.nix

@@ -1,12 +1,12 @@
 # Disko layout for idols-ai on nvme1n1 (target disk after migration).
 # Same structure as current nvme0n1: ESP + LUKS + btrfs with ephemeral root (tmpfs).
 #
-# Format & mount (from installer or live system):
-#   nix run github:nix-community/disko -- --mode disko ./disko-fs.nix
+# Destroy, format & mount (wipes disk; from nixos-installer: cd nix-config/nixos-installer):
+#   nix run github:nix-community/disko -- --mode destroy,format,mount ../hosts/idols-ai/disko-fs.nix
 # Mount only (after first format):
-#   nix run github:nix-community/disko -- --mode mount ./disko-fs.nix
+#   nix run github:nix-community/disko -- --mode mount ../hosts/idols-ai/disko-fs.nix
 #
-# Use by-id for stability; override device when installing, e.g.:
+# Override device when installing, e.g.:
 #   nixos-install --flake .#ai --option disko.devices.disk.nixos-ai.device /dev/nvme1n1
 {
   # Ephemeral root; preservation mounts /persistent for state.
@@ -24,8 +24,7 @@
 
     disk.nixos-ai = {
       type = "disk";
-      # Override at install time if needed: --option disko.devices.disk.nixos-ai.device /dev/nvme1n1
-      device = "/dev/nvme1n1";
+      device = "/dev/disk/by-id/nvme-KINGBANK_KP260_CN092BH3203917";
       content = {
         type = "gpt";
         partitions = {