Nomarchy/installer/disko-golden.nix

# Nomarchy Golden Path Disk Configuration
#
# BTRFS + LUKS2 encryption with subvolumes optimized for:
# - Compression (zstd)
# - SSD optimization (noatime)
# - Impermanence support (root-blank snapshot)
# - Separate subvolumes for home, nix store, logs
#
# Replace @TARGET_DRIVE@ with the target device (e.g., /dev/nvme0n1)

{
  disko.devices = {
    disk = {
      main = {
        type = "disk";
        device = "@TARGET_DRIVE@";
        content = {
          type = "gpt";
          partitions = {
            # EFI System Partition. 1 GiB leaves room for several kernel
            # generations + initrd + Plymouth assets without filling up.
            ESP = {
              priority = 1;
              name = "ESP";
              start = "1M";
              end = "1G";
              type = "EF00";
              content = {
                type = "filesystem";
                format = "vfat";
                mountpoint = "/boot";
                mountOptions = [ "umask=0077" ];
              };
            };

            # LUKS-encrypted root partition. The installer writes the
            # passphrase to an in-memory tmpfs (/dev/shm/nomarchy-luks.key)
            # rather than the spinning /tmp so the secret never touches disk.
            luks = {
              size = "100%";
              content = {
                type = "luks";
                name = "crypted";
                settings = {
                  allowDiscards = true;  # Enable TRIM for SSDs
                  passwordFile = "/dev/shm/nomarchy-luks.key";
                };
                content = {
                  type = "btrfs";
                  extraArgs = [ "-f" ];  # Force creation
                  subvolumes = {
                    # Root filesystem
                    "@" = {
                      mountpoint = "/";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };

                    # Persistent storage (for impermanence)
                    "@persist" = {
                      mountpoint = "/persist";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };

                    # User home directories
                    "@home" = {
                      mountpoint = "/home";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };

                    # Nix store (separate for better deduplication)
                    "@nix" = {
                      mountpoint = "/nix";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };

                    # System logs
                    "@log" = {
                      mountpoint = "/var/log";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };

                    # Snapshots — kept off the rolled-back root so tools like
                    # snapper / btrbk / nomarchy-rollback have a stable home.
                    "@snapshots" = {
                      mountpoint = "/.snapshots";
                      mountOptions = [ "compress=zstd" "noatime" ];
                    };
                  };

                  # Create a read-only snapshot of root for impermanence rollback
                  postCreateHook = ''
                    MNTPOINT=$(mktemp -d)
                    mount -t btrfs /dev/mapper/crypted $MNTPOINT
                    btrfs subvolume snapshot -r $MNTPOINT/@ $MNTPOINT/root-blank
                    umount $MNTPOINT
                  '';
                };
              };
            };
          };
        };
      };
    };
  };
}