search

cynicsketch / nix-mineral

Conveniently and reasonably harden NixOS.
MIT License
64 stars 3 forks source link

filesystems."/boot" causing error in certain EFI partition configurations #11

Open wyyllou opened 1 month ago

wyyllou commented 1 month ago

When using nix-mineral i came across this error: error: No device specified for mount point '/boot'. This is caused by me not using '/boot', and instead using '/boot/efi' as my boot mount.

Maybe this could be fixed by a toggle in nm-overrides? Im willing to work on that if you would like.

cynicsketch commented 1 month ago

Right now a viable method is to just attempt to mount both /boot and /boot/efi. Failed mounts are benign, and the following situations are possible:

  1. You have a separate /boot and /boot/efi. Both get mounted fine.
  2. You have a /boot OR /boot/efi. One gets mounted and you get the error: No device specified for mount point '/$OTHER'. but nothing bad happens.
  3. /boot is on the same partition as / and /boot doesn't get hardened because nix-mineral isn't currently smart enough to detect that whether it needs or doesn't need to be bind mounted. This is also a problem with any other directory.

Of course, there are smarter ways and we might be able to set up some basic dynamic detection and separate the individual options, but modularizing in this way hinges on submoduling every current default: https://github.com/cynicsketch/nix-mineral/issues/1

EDIT: Clarify

wyyllou commented 1 month ago

The error is actually in nix evaluation, and the obvious workaround is to add filesystems."/boot".device as /boot, which i suspect will make the mount fail, but evaluation successful.

slight tangent but still relevant to filesystems i currently manage my disks with disko, which changes the device field. i would advise adding lib.mkDefault to the device sections since i cannot add lib.mkForce if the filesystem config is inside an external module like disko.

wyyllou commented 1 month ago

My current situation is i have /, and /boot/efi (other partitions are irrelevant) so no /boot