Installing a New Workstation with NixOS
Published: 2021-05-07 10:52:42

---
title: Installing a New Workstation with NixOS
published: true
date: 2021-05-07 00:27:00 UTC
tags: 
canonical_url: https://kevincox.ca/2021/05/06/workstation-install-with-nixos/
---

<main><p>This post is half for the curious and half so that I can remember next time I get a new workstation.</p>
<h2 id="install-nixos"><a href="https://kevincox.ca/2021/05/06/workstation-install-with-nixos/#install-nixos">Install NixOS</a></h2>
<p>The first step is installing <a href="https://nixos.org">NixOS</a>. This is made easy with my <a href="https://gitlab.com/kevincox/nixos-auto-install">nixos-auto-install</a> image.</p>
<p>First you build the image.</p>
<div><pre><code>% <span>cd </span>nixos-auto-install
% nix-build
% pv result/iso/<span>*</span>.iso | <span>sudo </span>zsh <span>-c</span> <span>'&gt;/dev/disk/by-id/usb-Generic_Flash_Disk_1729B293-0:0'</span>
</code></pre></div>
<p>Then you plug it into the target machine and boot off of it. Odds are that it installs successfully and your system and reboots into NixOS. If not there are tips in the README.</p>
<h2 id="install-my-config"><a href="https://kevincox.ca/2021/05/06/workstation-install-with-nixos/#install-my-config">Install My Config</a></h2>
<p>I keep some secrets in my Git repo encrypted to prevent them being visible to any Git hosts or backups, so I need to copy the key to the new machine. I could copy my GPG key over now but I have had trouble with the password over SSH in the past so I find it easiest to copy over the repo key for now.</p>
<div><pre><code>% <span>cd </span>my-nix-config
% git crypt export-key /tmp/nix-key
% rsync /tmp/nix-key root@install.local:
% <span>rm</span> /tmp/nix-key
</code></pre></div>
<p>Log into the new machine.</p>
<div><pre><code>% ssh root@install.local
</code></pre></div>
<p>Clone and decrypt my config.</p>
<div><pre><code>install.local# git clone git@example:my-nix-config
install.local# cd my-nix-config
install.local# git crypt unlock ~/nix-key
install.local# rm ~/nix-key
</code></pre></div>
<h2 id="switch-to-my-configuration"><a href="https://kevincox.ca/2021/05/06/workstation-install-with-nixos/#switch-to-my-configuration">Switch to My Configuration</a></h2>
<p>I simply replace <code>/etc/nixos/configuration.nix</code> with a symlink to my Git repo. I also put the hostname in <code>/etc/nixos/hardware-configuration.nix</code>. I store the hostname on the system but most other host-specific changes are handled with conditionals in my config.</p>
<div><pre><code>install.local# <span>sed</span> <span>-ie</span> <span>'$ i\
\
	kevincox.id = "new-hostname";
'</span> /etc/nixos/hardware-configuration.nix
install.local# <span>mv</span> /etc/nixos/configuration.nix<span>{</span>,.bak<span>}</span>
install.local# <span>ln</span> <span>-s</span> ~/my-nix-config/desktop.nix /etc/nixos/configuration.nix
</code></pre></div>
<p>And finally build and apply the new config.</p>
<div><pre><code>install.local# nixos-rebuild <span>--upgrade</span> boot
install.local# reboot
</code></pre></div>
<h2 id="set-password-for-full-disk-encryption"><a href="https://kevincox.ca/2021/05/06/workstation-install-with-nixos/#set-password-for-full-disk-encryption">Set Password for Full Disk Encryption</a></h2>
<p><code>nixos-auto-install</code> sets up disk encryption but uses a single null byte as the key. We disable the automatic decryption attempt in preparation for setting our own password. If a rollback is needed the old config will still work because of the <code>fallbackToPassword = true</code>.</p>
<div><pre><code><span>--- a/etc/nixos/hardware-configuration.nix
</span><span>+++ b/etc/nixos/hardware-configuration.nix
</span><span>@@ -18,14 +18,6 @@</span>
<span>-
- # Set your own key with:
- # cryptsetup luksChangeKey /dev/disk/by-label/root --key-file=/dev/zero --keyfile-size=1
- # You can then delete the rest of this block.
- keyFile = "/dev/zero";
- keyFileSize = 1;
-
- fallbackToPassword = true;
</span></code></pre></div>
<p>Set the new password. The truly paranoid may prefer to rotate the disk key in case someone can recover the key from the previous insecure key-slot, however for most people this is probably secure enough.</p>
<div><pre><code>new-hostname% <span>sudo </span>cryptsetup luksChangeKey /dev/disk/by-label/root <span>--key-file</span><span>=</span>/dev/zero <span>--keyfile-size</span><span>=</span>1
Password:
Confirm:
new-hostname% <span>sudo </span>nixos-rebuild switch
</code></pre></div>
<p>Rebooting here isn’t necessary but it is probably a good idea just to ensure that you can still decrypt your disk. Otherwise you may waste some time in the rare case that updating the key failed for whatever reason.</p>
<h2 id="clean-up-the-bootstrapping-process"><a href="https://kevincox.ca/2021/05/06/workstation-install-with-nixos/#clean-up-the-bootstrapping-process">Clean Up the Bootstrapping Process</a></h2>
<p>At this point my personal user has been created so I move my Nix config into my own home directory.</p>
<div><pre><code>new-hostname% <span>mkdir </span>p
new-hostname% <span>sudo mv</span> ~root/my-nix-config p
new-hostname% <span>sudo chown</span> <span>-R</span> kevincox: p/my-nix-config
new-hostname% <span>sudo ln</span> <span>-s</span> ~/p/my-nix-config/desktop.nix /etc/nixos/configuration.nix
</code></pre></div>
<h2 id="done"><a href="https://kevincox.ca/2021/05/06/workstation-install-with-nixos/#done">Done</a></h2>
<p>There we go. I have a system with most of my configuration ready to go. I have all of my favourite programs installed, configurations for many tools set up and even some desktop setting tweaked to my preference. I don’t manage all of my configs and state with Nix at this point (for example my Vim config lives in a separate repo in case I need to use a non-NixOS machine in a future job) and I need to log into Firefox Sync but the system is already comfortable to me. It is really amazing to install a new system without the “oh right, I haven’t installed X yet” breaking your workflow every could of hours for the first few weeks.</p>