4 ms·
It’s much less plug-and-play than the options in the article… but I’ve had fun with a related idea, which is running Nixos on storage where root is erased on ev
by heisenzombie 4y ago
It’s much less plug-and-play than the options in the article… but I’ve had fun with a related idea, which is running Nixos on storage where root is erased on every boot.
My home server is set up this way. At the time, I more or less followed this guide, which explains things nicely:
https://grahamc.com/blog/erase-your-darlings/ https://grahamc.com/blog/erase-your-darlings/
Been erasing root for almost 2 years I think now. Works great!
- LanternLight83 4y agoI've cloned this setup for BTRFS on Guix, which took some questionable hacks because they don't have all the hooks I needed throughout the boot process... still meaning to migrate it to ZFS on Root, which will entail yet more hacks. Going for it though c:
- tripleo1 4y ago> I've cloned this setup for BTRFS on Guix Please share :)
- ochoseis 4y agoOne of the hurdles with this approach is that _everything_ has to live in configuration.nix. How are you handling secrets like your host keys? I recently got sops-nix working as a prototype, but curious if there are better ways. Side note: everything living in configuration.nix makes flake-ifying your system a lot easier, which is a win in my book.
- anotherhue 4y agoThere's a nix way to read a secret from a file. I'm not sure if it still ends up in the nix store that way but at least it's not in the config file so your VCS is clean.
- piperswe 4y agoTypically with NixOS, you'll have systemd or a wrapper script read the secret from a file into an environment variable for the service that needs the secret. This secret file would be stored in `/var/lib` or similar, outside the Nix store. There isn't really a "Nix" way, just a pattern used in various places in NixOS.
- whateveracct 4y agoI know NixOps has a way to handle keys without putting them in the store and without having to do some out-of-band file management: https://nixops.readthedocs.io/en/latest/overview.html#managing-keys https://nixops.readthedocs.io/en/latest/overview.html#managi...
- anotherhue 4y agoI mount '/' as a tmpfs which seems saner than manually deleting. IMO.
- amarshall 4y agoIt depends on how much ephemeral data one expects to have. E.g. browser cache on tmpfs can use a fair bit of the often-more-limited RAM space.