System/Nixinator: Mount /boot with umask=077

config/navi/christoph.cheat

@@ -322,3 +322,16 @@ $ drive: eza -1 /dev | rg --trim -e "^nvme\dn\dp\d" | sd "n\dp\d" "" | sort -u
 # Query NVME SSD used percentage
 sudo nvme smart-log /dev/<drive> | rg --trim "percentage_used"
 $ drive: eza -1 /dev | rg --trim -e "^nvme\dn\dp\d" | sd "n\dp\d" "" | sort -u
+
+% cryptsetup
+# Open LUKS device
+sudo cryptsetup luksOpen /dev/<drive> <label>
+$ drive: eza -1 /dev | rg --trim -e "^nvme\dn\dp\d" | sd "n\dp\d" "" | sort -u
+
+% cryptsetup
+# Close LUKS device
+sudo cryptsetup luksClose <label>
+
+% disko
+# Partition and format disks
+sudo disko --mode disko --flake .#<target>

home/modules/fish/default.nix

@@ -137,7 +137,8 @@ in {
             cdd = "zi";
             b = "z -"; # jump to previous dir
             mkdir = "mkdir -p"; # also create parents (-p)
-            blk = batify "lsblk -o NAME,LABEL,PARTLABEL,FSTYPE,SIZE,FSUSE%,MODEL,ID,UUID,MOUNTPOINT";
+            blk = batify "lsblk -o NAME,LABEL,PARTLABEL,FSTYPE,SIZE,FSUSE%,MOUNTPOINT";
+            blkid = batify "lsblk -o NAME,LABEL,FSTYPE,SIZE,PARTLABEL,MODEL,ID,UUID";
             watch = "watch -d -c -n 0.5";
             nd = "nix develop";
             nb = "nix build -L";

system/nixinator/disks.nix

@@ -8,6 +8,8 @@
           type = "gpt";
           partitions = {
             ESP = {
+              # NOTE: The disk identification uses /dev/disk/by-partlabel,
+              #       so make sure this matches the actual partlabel!!!
               label = "EFI";
               size = "512M";
               type = "EF00";
@@ -15,7 +17,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = ["defaults"];
+                mountOptions = ["umask=077"];
               };
             };
             luks = {

system/nixinator/hardware-configuration.nix

@@ -41,14 +41,14 @@
     ];
   };
 
-  # NOTE: Some filesystems are managed by disko (see ./disks.nix)
   fileSystems = {
-    # TODO: Reformat
-    # "/home/christoph/Games" = {
-    #   device = "/dev/disk/by-uuid/e57c1831-09d7-4046-9c62-086d3596f825";
-    #   fsType = "ext4";
-    #   options = ["defaults" "rw" "relatime"];
-    # };
+    # NOTE: Some filesystems are managed by disko (see ./disks.nix)
+
+    "/home/christoph/Games" = {
+      device = "/dev/disk/by-id/nvme-WD_BLACK_SN850X_2000GB_231623802252-part1";
+      fsType = "ext4";
+      options = ["defaults" "rw" "noatime"];
+    };
 
     # If  the bg option is specified, a timeout or failure causes the mount(8) command
     # to fork a child which continues to attempt to mount the export.
@@ -66,19 +66,19 @@
     "/home/christoph/Movies" = {
       device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Movie";
       fsType = "nfs";
-      options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
+      options = ["defaults" "rw" "noatime" "_netdev" "bg" "soft"];
     };
 
     "/home/christoph/Shows" = {
       device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Show";
       fsType = "nfs";
-      options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
+      options = ["defaults" "rw" "noatime" "_netdev" "bg" "soft"];
     };
 
     "/home/christoph/Music" = {
       device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Music";
       fsType = "nfs";
-      options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
+      options = ["defaults" "rw" "noatime" "_netdev" "bg" "soft"];
     };
   };