1. booting(8)
  3. booting(8)

NAME

booting - it is now safe to turn off your computer

The swap partition size must be at least the size of RAM plus square root of RAM size. Hibernation is reccomended for all systems. 20 = {๐•ฉ+โˆš๐•ฉ} 16 or for the full list up to 32G {โŒˆ๐•ฉ+โˆš๐•ฉ}ยจโ†•32

UEFI

/dev/sda1, system
occupies 500MB to -$swap_size
/dev/sda2, swap
occupies -$swap_size to 100%
/dev/sda3, boot
occupies 0 to 500MB

follow the lanzaboote instructions, this will be important later.

TPM encryption for system files + secure boot is a good base, but doesn't do much to protect user data. making hard user separation user-friendly seems like a stretch, but creating useful hooks might be an interesting and useful start.

MBR / LEGACY BOOT

/dev/sda1, 500M
boot
/dev/sda2, 2M
BIOS boot
/dev/sda3, $swap_size
SWAP
/dev/sda4, $rest
SYSTEM

GRUB only supports luks1-formatted disks. purism has some kind of secure legacy boot thing going on, but it seems more practical to flash coreboot with a UEFI payload and use lanzaboote.

cryptsetup luksFormat --type luks1 -h sha512 $rootpart

configure legacy boot! some of this will be picked up by nixos-generate-config, but you should verify that all of these settings are following the right pattern.

{
  boot.loader.grub.enable = true;
  boot.loader.grub.device = "/dev/sda";
  boot.loader.grub.enableCryptodisk = true;
  boot.initrd.luks.devices.crypted.device = "/dev/disk/by-partuuid/UUID";
  fileSystems."/".device = "/dev/mapper/crypted";
}
  1. IX
  2. March 2025
  3. booting(8)