563 words

3 minutes

Install NixOS with encrypted Btrfs and a IN-RAM root (without hibernation)

2025-07-22

Linux

/

NixOS

/

Installation

/

Filesystem

/

Encryption

0. Pre-installation#

1.Connect to the internet#

Generate configuration file

1
wpa_passphrase "WiFi_SSID" "WiFi_PASSWORD" | tee /etc/whatever.conf

Check the device name

1
ip a

Connect to the network

1
wpa_supplicant -B -i "devicename" -c /etc/whatever.conf

2.Proxy (optional)#

1
nix-shell -p xray
2
xray run -c /path/to/config.json
3
export http_proxy=http://127.0.0.1:port
4
export https_proxy=http://127.0.0.1:port
5
export ALL_PROXY=socks5h://127.0.0.1:port

1. Format and partition#

1.Create the GPT partition table#

1
parted /dev/sdX mklabel gpt

2.Create the UEFI FAT32 partition (which will be /dev/sdXY)#

1
parted /dev/sdX mkpart esp fat32 1MiB 512MiB
2
parted /dev/sdX set 1 esp on
3
parted /dev/sdX set 1 boot on
4
mkfs.fat -F 32 -n UEFI /dev/sdXY

3.Create the SWAP partition (which will be /dev/sdXW) (optional)#

1
parted /dev/sdX mkpart swap linux-swap 512MiB 4.5GiB
2
mkswap -L SWAP /dev/sdXW

4.Create the NIXOS BTRFS partition with encryption (which will be /dev/sdXZ)#

1
parted /dev/sdX mkpart nixos btrfs 4.5GiB 100%
2
cryptsetup --verify-passphrase -v luksFormat /dev/sdXZ
3
cryptsetup open /dev/sdXZ enc
4
mkfs.btrfs -L NIXOS /dev/mapper/enc

2. Setup BTRFS subvolumes#

1.Mount the NIXOS partition#

1
mount -t btrfs /dev/mapper/enc /mnt

2.Create the NIX partition subvolume#

1
btrfs subvolume create /mnt/@nix

3.Create the HOME partition subvolume#

1
btrfs subvolume create /mnt/@home

4.Create the snapshots subvolume#

1
btrfs subvolume create /mnt/@home/.snapshots

5.Unmount the NIXOS partition#

1
umount /mnt

3. Mount the partitions for installation#

1.Mount the in-ram ROOT partition#

1
mount -t tmpfs -o noatime,mode=755 none /mnt

2.Create persistent directories on which to mount partitions#

1
mkdir /mnt/{boot,nix,home}
2
mkdir /mnt/home/.snapshots

3.Mount the UEFI partition#

1
mount -t vfat -o defaults,noatime,fmask=0077,dmask=0077 /dev/sdXY /mnt/boot

4.Mount the NIX partition subvolume#

1
mount -t btrfs -o noatime,compress=zstd,subvol=@nix /dev/mapper/enc /mnt/nix

5.Mount the HOME partition subvolume#

1
mount -t btrfs -o noatime,compress=zstd,subvol=@home /dev/mapper/enc mnt/home

6.Mount the SNAPSHOTS partition subvolume#

1
mount -t btrfs -o noatime,compress=zstd,subvol=@home/.snapshots /dev/mapper/enc /mnt/home/.snapshots

7.Mount the SWAP partition (optional)#

1
swapon /dev/sdXW

4. Generate NixOS configs & install#

1.Let NixOS generate template configurations#

1
nixos-generate-config --root /mnt

2.Make sure all mount points in hardware-configuration.nix are identical to the previous section#

1
vim /mnt/etc/nixos/hardware-configuration.nix

Example

1
  fileSystems."/boot" = {
2
    device = "/dev/disk/by-uuid/XXX";
3
    fsType = "vfat";
4
    options = [
5
      "fmask=0077"
6
      "dmask=0077"
7
    ];
8
  };
9

10
  boot.initrd.luks.devices."enc".device = "/dev/disk/by-uuid/XXX";
11

12
  fileSystems."/nix" = {
13
    device = "/dev/disk/by-uuid/XXX";
14
    fsType = "btrfs";
15
    options = [
16
      "subvol=@nix"
17
      "compress=zstd"
18
      "noatime"
19
    ];
20
  };
21

22
  fileSystems."/home" = {
23
    device = "/dev/disk/by-uuid/XXX";
24
    fsType = "btrfs";
25
    options = [
26
      "subvol=@home"
27
      "compress=zstd"
28
      "noatime"
29
    ];
30
  };
31

32
  fileSystems."/home/.snapshots" = {
33
    device = "/dev/disk/by-uuid/XXX";
34
    fsType = "btrfs";
35
    options = [
36
      "subvol=@home/.snapshots"
37
      "compress=zstd"
38
      "noatime"
39
    ];
40
  };
41

42
  swapDevices = [
43
    {
44
      device = "/dev/disk/by-partuuid/XXX";
45
      randomEncryption.enable = true;
46
    }
47
  ];

NOTE
Don’t try to hibernate when you have at least one swap partition with randomEncryption enabled! We have no way to set the partition into which hibernation image is saved, so if your image ends up on an encrypted one you would lose it!
Do not use /dev/disk/by-uuid/… or /dev/disk/by-label/… as your swap device when using randomEncryption as the UUIDs and labels will get erased on every boot when the partition is encrypted. Best to use /dev/disk/by-partuuid/…

3.Edit the configuration.nix file as needed#

1
vim /mnt/etc/nixos/configuration.nix

Disable users mutability:

1
users.mutableUsers = false;

Add user (hashed) password: (In another console: nix-shell --run 'mkpasswd -m SHA-512 -s' -p mkpasswd)

1
users.users.<USERNAME>.initialHashedPassword = "<HASHED_PASSWORD>";

4.Start the installer#

1
nixos-install --no-root-passwd
2
reboot

5. Post-installation#

1.Keep nixos folder#

1
mkdir /mnt/nix/persist/etc
2
cp -r /etc/nixos /mnt/nix/persist/etc/

2.Use impermanence to persist necessary files#

Add to flake.nix inputs

1
impermanence.url = "github:nix-community/impermanence";

configuration.nix

1
{
2
  inputs,
3
  config,
4
  pkgs,
5
  lib,
6
  ...
7
}:
8
{
9
  # persist
10
  imports = [ inputs.impermanence.nixosModules.impermanence ];
11
  environment.persistence."/nix/persist" = {
12
    hideMounts = true;
13
    directories = (
14
      [
15
        "/var/log"
16
        "/var/lib/nixos"
17
        "/var/lib/systemd/coredump"
18
        "/var/lib/systemd/timers"
19
        "/var/lib/bluetooth"
20
        "/etc/nixos"
21
        "/etc/NetworkManager/system-connections"
22
        {
23
          directory = "/var/lib/colord";
24
          user = "colord";
25
          group = "colord";
26
          mode = "u=rwx,g=rx,o=";
27
        }
28
      ]
29
      ++ lib.optional config.virtualisation.libvirtd.enable "/var/lib/libvirt"
30
    );
31
    files = (
32
      [
33
        "/etc/machine-id"
34
        {
35
          file = "/etc/nix/id_rsa";
36
          parentDirectory = {
37
            mode = "u=rwx,g=rx,o=rx";
38
          };
39
        }
40
      ]
41
      ++ lib.optionals config.services.openssh.enable [
42
        "/etc/ssh/ssh_host_rsa_key"
43
        "/etc/ssh/ssh_host_rsa_key.pub"
44
        "/etc/ssh/ssh_host_ed25519_key"
45
        "/etc/ssh/ssh_host_ed25519_key.pub"
46
      ]
47
    );
48
  };
49
  security.sudo.extraConfig = ''
50
    Defaults lecture = never
51
  '';
52
}

Reference:

Install NixOS with encrypted Btrfs and a IN-RAM root (without hibernation)

https://blog.randomneet.me/posts/linux/nixos-install-nohibernate/

Author

RandomNEET

Published at

2025-07-22

License

CC BY-NC-SA 4.0

Enable Secure Boot on NixOS

1

0. Pre-installation

1.Connect to the internet

2.Proxy (optional)

2

1. Format and partition

1.Create the GPT partition table

2.Create the UEFI FAT32 partition (which will be /dev/sdXY)

3.Create the SWAP partition (which will be /dev/sdXW) (optional)

4.Create the NIXOS BTRFS partition with encryption (which will be /dev/sdXZ)

3

2. Setup BTRFS subvolumes

1.Mount the NIXOS partition

2.Create the NIX partition subvolume

3.Create the HOME partition subvolume

4.Create the snapshots subvolume

5.Unmount the NIXOS partition

4

3. Mount the partitions for installation

1.Mount the in-ram ROOT partition

2.Create persistent directories on which to mount partitions

3.Mount the UEFI partition

4.Mount the NIX partition subvolume

5.Mount the HOME partition subvolume

6.Mount the SNAPSHOTS partition subvolume

7.Mount the SWAP partition (optional)

5

4. Generate NixOS configs & install

1.Let NixOS generate template configurations

2.Make sure all mount points in hardware-configuration.nix are identical to the previous section

3.Edit the configuration.nix file as needed

4.Start the installer

6

5. Post-installation

1.Keep nixos folder

2.Use impermanence to persist necessary files