Add setup instructions

[0xlua]

This repo is a flake and can be installed like one, however some actions have to be taken before doing so, mostly relating to file systems and secrets. I want to document these for future reference:

• Install NixOS with FDE¹ (see Full Disk Encryption & Secure Boot #126)
• enable secure boot: with sbctl create-keys and lanzaboote, also see Full Disk Encryption & Secure Boot #126
• generate an age key² and add it to .sops.yaml
• generate an ssh key³ and add it to authorizedKeys (also see ssh: use authorized keys file instead of hardcoded keys #201)
• obtain a PGP Key for Email encryption, add to stalwart and publish (also see Mail & Calendar clients #134)

Footnotes

1. Using the option in the NixOS Installer or disko ↩

2. preferably with something like age-plugin-yubikey or age-plugin-tpm ↩

3. preferably stored in TPM or YubiKey, also see Secret Management #127 ↩

[0xlua]

Installation

These steps apply only to europa at the moment. I have yet to migrate callisto and ganymede to Full Disk Encryption.

• Make sure Secure Boot is enabled and in Setup Mode
• Download the NixOS Installer, follow the instructions and use the following settings during installation:
  • Language: American English, Europe/Berlin, English (US, intl., with dead keys)
  • username: lua
  • Patition: no swap, btrfs, Encrypt Drive
• Reboot and check if Secure Boot is supported: bootctl status
• You need my age key and put it in `/home/lua/.config/sops/age/key or setup your own sops-nix
• Build flake: sudo nixos-rebuild switch --flake github:0xlua/dotfiles#<host>
• Secure Boot Keys will automatically be created and enrolled after another reboot
• Make sure Secure Boot is ready to go: sudo sbctl verify

Some stuff still won't work, since they aren't included in the flake:

• GPG keys for email encryption/decrtyption
• SSH keys for git, servers and work
• age keys for sops-nix
• Config stored in podman volumes

Future considerations

• make username, email, etc. configurable -> no hardcoded values in rest of config
• Impermanence: Make sure important paths persist: e.g. Secure Boot keys. Persistent Paths overlap with what should be backed up.
• Measured Boot: Includes unlocking the disk using TPM, be aware of this attack - use at least a pin
• Bcachefs
• Automatic / Remote Install: nixos-anywhere with disko
• Switch from sops-nix to fnox