To significantly increase security, I'd like to encrypt my disk and use Secure Boot. A lot of the required steps are not declarative and will require further documentation, once implemented (see #205).
Since this requires a reinstall I can largely follow the installation guide on the NixOS Wiki.
Full Disk Encryption
A lot of information is covered in the Wiki.
- First download a recent ISO, create a bootable media, etc...
- Before booting: make sure Secure Boot is disabled
- The only really important thing during install is the disk partinioning, since this can't be changed later
- Select the "Encrypt" Option during the installation process
Secure Boot
Once FDE is setup and the system is installed, I can deploy Secure Boot.
Again there is a lot of information on the Wiki.
Follow this guide
For Secure Boot Lanzaboote is needed: Guide
Additional Notes
Full Disk Encryption and Secure Boot are the most important things, but there are some more nice to haves. These aren't part of the scope for this issue, but I still think these are interesting.
Filesystem choice
TBD: Bcachefs vs Btrfs
Automatic / Remote Install & Disko
I think in the future a more automatic install process might be desireable, compared to the manual install described above.
An obvious choice would be nixos-anywhere which also uses disko (Wiki).
Impermanence
This issue originally was also about Impermanence, however this is less important to me than FDE and Secure Boot and adds a significant amount of complexity to the setup. I still think it's interesting, especially in combination with the planned Backup solution (see #124), so I might pursue this again in the future.
Here are some more links, but they are mostly outdated and should be merely seen as inspiration:
To significantly increase security, I'd like to encrypt my disk and use Secure Boot. A lot of the required steps are not declarative and will require further documentation, once implemented (see #205).
Since this requires a reinstall I can largely follow the installation guide on the NixOS Wiki.
Full Disk Encryption
A lot of information is covered in the Wiki.
Secure Boot
Once FDE is setup and the system is installed, I can deploy Secure Boot.
Again there is a lot of information on the Wiki.
Follow this guide
For Secure Boot Lanzaboote is needed: Guide
Additional Notes
Full Disk Encryption and Secure Boot are the most important things, but there are some more nice to haves. These aren't part of the scope for this issue, but I still think these are interesting.
Filesystem choice
TBD: Bcachefs vs Btrfs
Automatic / Remote Install & Disko
I think in the future a more automatic install process might be desireable, compared to the manual install described above.
An obvious choice would be nixos-anywhere which also uses disko (Wiki).
Impermanence
This issue originally was also about Impermanence, however this is less important to me than FDE and Secure Boot and adds a significant amount of complexity to the setup. I still think it's interesting, especially in combination with the planned Backup solution (see #124), so I might pursue this again in the future.
Here are some more links, but they are mostly outdated and should be merely seen as inspiration: