nix-git/hosts/yodaYoga/disko-config.nix

# TODO: I haven't used this config file yet.

# Example taken form https://github.com/nix-community/disko/blob/master/example/luks-btrfs-subvolumes.nix

# cryptsetup luksOpen --allow-discards
#
#   https://wiki.gentoo.org/wiki/Dm-crypt_full_disk_encryption#Dm-crypt_on_SSDs_and_hybrid_drives
#     Cryptsetup can transparently forward discard operations to an SSD. This feature is activated by using the --allow-discards option in combination with cryptsetup open. Enabling discards on an encrypted SSD can be a measure to ensure effective wear leveling and longevity, especially if the full disk is encrypted. For an in detail discussion about the security implications, have a look at the cryptsetup FAQ and the man page of cryptsetup.
#
#   https://man.archlinux.org/man/cryptsetup-luksOpen.8.en
#     Can make filesystem-level operations visible on the physical device. For example, information leaking filesystem type, used space, etc. may be extractable from the physical device.

{
  disko.devices = {
    disk = {
      "256GB1" = {
        type = "disk";
        # Device nickname: 256GB1
        device = "/dev/disk/by-id/ata-SanDisk_SD7TB6S256G1001_161418401077";
        content = {
          type = "gpt";
          partitions = {
            ESP = {
              label = "EFI";
              name = "ESP";
              size = "512M";
              type = "EF00";
              content = {
                type = "filesystem";
                format = "vfat";
                mountpoint = "/boot";
                mountOptions = [
                  "defaults"
                ];
              };
            };
            luks = {
              size = "100%";
              content = {
                type = "luks";
                  name = "256GB1";
                extraOpenArgs = [ "--allow-discards" ];
                # if you want to use the key for interactive login be sure there is no trailing newline
                # for example use `echo -n "password" > /tmp/secret.key`
                passwordFile = "/tmp/secret.key"; # Interactive login.
                #settings.keyFile = "/tmp/secret.key";
                #additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
                content = {
                  type = "btrfs";
                  extraArgs = [ "-f" ];
                  subvolumes = {
                    "/@" = {
                      mountpoint = "/";
                      mountOptions = [ "compress=zstd" "noatime" "commit=120" ];
                    };
                    "/@home" = {
                      mountpoint = "/home";
                      mountOptions = [ "compress=zstd" "noatime" "commit=120" ];
                    };
                    # For snapshots created with e.g. `btrbk`.
                    "/@snap" = {
                      mountpoint = "/snap";
                      mountOptions = [ "compress=zstd" "noatime" "commit=120" ];
                    };
                  };
                };
              };
            };
          };
        };
      };
    };
  };
}