503 words

3 minutes

Install NixOS with encrypted Btrfs and a IN-RAM root (with hibernation)

2025-09-10

Linux

/

NixOS

/

Installation

/

Filesystem

/

Encryption

1. Format and partition#

1.Create the GPT partition table#

1
parted /dev/sdX mklabel gpt

2.Create the UEFI FAT32 partition (which will be /dev/sdXY)#

1
parted /dev/sdX mkpart esp fat32 1MiB 512MiB
2
parted /dev/sdX set 1 esp on
3
parted /dev/sdX set 1 boot on
4
mkfs.fat -F 32 -n UEFI /dev/sdXY

3.Create an encrypted partition for LVM (which will be /dev/sdXZ)#

1
parted /dev/sdX mkpart primary 512MiB 100%
2
parted /dev/sdX set 2 lvm on
3
cryptsetup --verify-passphrase -v luksFormat /dev/sdXZ

4.Create LVM volumes#

1
cryptsetup open /dev/sdXZ enc
2
pvcreate /dev/mapper/enc
3
vgcreate vg0 /dev/mapper/enc

5.Create the swap volume (which will be /dev/vg0/swap)#

1
lvcreate -L 48G -n swap vg0
2
mkswap -L SWAP /dev/vg0/swap

6.Create the NixOS Btrfs volume (which will be /dev/vg0/main)#

1
lvcreate -l 100%FREE -n main vg0
2
mkfs.btrfs -L NIXOS /dev/vg0/main

2. Setup BTRFS subvolumes#

1.Mount the NIXOS volume#

1
mount -t btrfs /dev/vg0/main /mnt

2.Create the NIX subvolume#

1
btrfs subvolume create /mnt/@nix

3.Create the HOME subvolume#

1
btrfs subvolume create /mnt/@home

4.Create the snapshots subvolume#

1
btrfs subvolume create /mnt/@home/.snapshots

5.Unmount the NIXOS volume#

1
umount /mnt

3. Mount the partitions for installation#

1.Mount the in-ram ROOT partition#

1
mount -t tmpfs -o noatime,mode=755 none /mnt

2.Create persistent directories on which to mount partitions#

1
mkdir /mnt/{boot,nix,home}
2
mkdir /mnt/home/.snapshots

3.Mount the UEFI partition#

1
mount -t vfat -o defaults,noatime,fmask=0077,dmask=0077 /dev/sdXY /mnt/boot

4.Mount the NIX subvolume#

1
mount -t btrfs -o noatime,compress=zstd,subvol=@nix /dev/vg0/main /mnt/nix

5.Mount the HOME subvolume#

1
mount -t btrfs -o noatime,compress=zstd,subvol=@home /dev/vg0/main /mnt/home

6.Mount the SNAPSHOTS subvolume#

1
mount -t btrfs -o noatime,compress=zstd,subvol=@home/.snapshots /dev/vg0/main /mnt/home/.snapshots

7.Mount swap#

1
swapon /dev/vg0/swap

4. Generate NixOS configs & install#

1.Let NixOS generate template configurations#

1
nixos-generate-config --root /mnt

2.Make sure all mount points in hardware-configuration.nix are identical to the previous section#

1
vim /mnt/etc/nixos/hardware-configuration.nix

Example

1
  fileSystems."/" = {
2
    device = "none";
3
    fsType = "tmpfs";
4
    options = [
5
      "noatime"
6
      "size=3G"
7
      "mode=755"
8
    ];
9
  };
10

11
  fileSystems."/boot" = {
12
    device = "/dev/disk/by-uuid/XXX";
13
    fsType = "vfat";
14
    options = [
15
      "fmask=0077"
16
      "dmask=0077"
17
    ];
18
  };
19

20
  boot.initrd.luks.devices."enc".device = "/dev/disk/by-uuid/XXX";
21

22
  fileSystems."/nix" = {
23
    device = "/dev/disk/by-uuid/XXX";
24
    fsType = "btrfs";
25
    options = [
26
      "subvol=@nix"
27
      "compress=zstd"
28
      "noatime"
29
    ];
30
  };
31

32
  fileSystems."/home" = {
33
    device = "/dev/disk/by-uuid/XXX";
34
    fsType = "btrfs";
35
    options = [
36
      "subvol=@home"
37
      "compress=zstd"
38
      "noatime"
39
    ];
40
  };
41

42
  fileSystems."/home/.snapshots" = {
43
    device = "/dev/disk/by-uuid/XXX";
44
    fsType = "btrfs";
45
    options = [
46
      "subvol=@home/.snapshots"
47
      "compress=zstd"
48
      "noatime"
49
    ];
50
  };
51

52
  swapDevices = [
53
    { device = "/dev/disk/by-uuid/XXX"; }
54
  ];

NOTE
Add the following line manually:
1
boot.initrd.luks.devices."enc".device = "/dev/disk/by-uuid/XXX";
Replace XXX with the actual UUID (check with blkid /dev/sdXZ).
Without this line, the system will not boot.

3.Edit the configuration.nix file as needed#

1
vim /mnt/etc/nixos/configuration.nix

Disable users mutability:

1
users.mutableUsers = false;

Add user (hashed) password: (In another console: nix-shell --run 'mkpasswd -m SHA-512 -s' -p mkpasswd)

1
users.users.<USERNAME>.initialHashedPassword = "<HASHED_PASSWORD>";

4.Start the installer#

1
nixos-install --no-root-passwd
2
reboot

5. Post-installation#

1.Keep nixos folder#

1
mkdir /mnt/nix/persist/etc
2
cp -r /etc/nixos /mnt/nix/persist/etc/

2.Use impermanence to persist necessary files#

Add to flake.nix inputs

1
impermanence.url = "github:nix-community/impermanence";

configuration.nix

1
{
2
  inputs,
3
  config,
4
  pkgs,
5
  lib,
6
  ...
7
}:
8
{
9
  # persist
10
  imports = [ inputs.impermanence.nixosModules.impermanence ];
11
  environment.persistence."/nix/persist" = {
12
    hideMounts = true;
13
    directories = (
14
      [
15
        "/var/log"
16
        "/var/lib/nixos"
17
        "/var/lib/systemd/coredump"
18
        "/var/lib/systemd/timers"
19
        "/var/lib/bluetooth"
20
        "/etc/nixos"
21
        "/etc/NetworkManager/system-connections"
22
        {
23
          directory = "/var/lib/colord";
24
          user = "colord";
25
          group = "colord";
26
          mode = "u=rwx,g=rx,o=";
27
        }
28
      ]
29
      ++ lib.optional config.virtualisation.libvirtd.enable "/var/lib/libvirt"
30
    );
31
    files = (
32
      [
33
        "/etc/machine-id"
34
        {
35
          file = "/etc/nix/id_rsa";
36
          parentDirectory = {
37
            mode = "u=rwx,g=rx,o=rx";
38
          };
39
        }
40
      ]
41
      ++ lib.optionals config.services.openssh.enable [
42
        "/etc/ssh/ssh_host_rsa_key"
43
        "/etc/ssh/ssh_host_rsa_key.pub"
44
        "/etc/ssh/ssh_host_ed25519_key"
45
        "/etc/ssh/ssh_host_ed25519_key.pub"
46
      ]
47
    );
48
  };
49
  security.sudo.extraConfig = ''
50
    Defaults lecture = never
51
  '';
52
}

Reference:

Install NixOS with encrypted Btrfs and a IN-RAM root (with hibernation)

https://blog.randomneet.me/posts/linux/nixos-install-hibernate/

Author

RandomNEET

Published at

2025-09-10

License

CC BY-NC-SA 4.0

Unable to start VMs after flake update

1

1. Format and partition

1.Create the GPT partition table

2.Create the UEFI FAT32 partition (which will be /dev/sdXY)

3.Create an encrypted partition for LVM (which will be /dev/sdXZ)

4.Create LVM volumes

5.Create the swap volume (which will be /dev/vg0/swap)

6.Create the NixOS Btrfs volume (which will be /dev/vg0/main)

2

2. Setup BTRFS subvolumes

1.Mount the NIXOS volume

2.Create the NIX subvolume

3.Create the HOME subvolume

4.Create the snapshots subvolume

5.Unmount the NIXOS volume

3

3. Mount the partitions for installation

1.Mount the in-ram ROOT partition

2.Create persistent directories on which to mount partitions

3.Mount the UEFI partition

4.Mount the NIX subvolume

5.Mount the HOME subvolume

6.Mount the SNAPSHOTS subvolume

7.Mount swap

4

4. Generate NixOS configs & install

1.Let NixOS generate template configurations

2.Make sure all mount points in hardware-configuration.nix are identical to the previous section

3.Edit the configuration.nix file as needed

4.Start the installer

5

5. Post-installation

1.Keep nixos folder

2.Use impermanence to persist necessary files