support unencrypted disk provisioning

nix/os/devices/default.nix

@@ -1,16 +1,23 @@
-{ pkgs ? import <channels-nixos-stable> {}
+{ dir
+, pkgs ? import <channels-nixos-stable> {}
 , ownLib ? import ../lib/default.nix { }
-, dir
-, rebuildarg
-, moreargs ? ""
-, diskId ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.encryptedDisk.diskId
 , gitRoot ? "$(git rev-parse --show-toplevel)"
-, previousDiskId ? ""
-}:
+
+# FIXME: why do these need explicit mentioning?
+, moreargs ? null
+, rebuildarg ? ""
+, ...
+} @ args :
 
 let
   rebuildargsSudo = [ "switch" "boot" ];
-  rebuild = pkgs.writeScript "script" ''
+  rebuild = {
+    rebuildarg
+    , gitRoot
+    , moreargs ? null
+
+    , ...
+  }: pkgs.writeScript "script" ''
     #!/usr/bin/env bash
     set -xe
 
@@ -35,6 +42,7 @@ let
 
 in {
   recipes = {
-    inherit rebuild;
-  } // (import ./disk.nix { inherit pkgs ownLib dir rebuildarg moreargs diskId gitRoot previousDiskId; });
+    rebuild = rebuild { inherit gitRoot; inherit (args) rebuildarg moreargs; };
+  } // (import ./disk.nix (args // { inherit pkgs ownLib gitRoot; }))
+  ;
 }

nix/os/devices/disk.nix

@@ -1,11 +1,12 @@
 { pkgs
 , ownLib
 , dir
-, rebuildarg
-, moreargs
-, diskId
 , gitRoot
+, diskId ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.opinionatedDisk.diskId
+, encrypted ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.opinionatedDisk.encrypted
 , previousDiskId ? ""
+
+, ...
 }:
 
 let
@@ -16,7 +17,9 @@ in rec {
     #!/usr/bin/env bash
     set -xe
     echo Mounting ${diskId}
-    sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+    ${pkgs.lib.strings.optionalString encrypted ''
+      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+    ''}
     sleep 1
     sudo vgchange -ay ${ownLib.disk.volumeGroup diskId}
     sudo mkdir -p /mnt
@@ -32,7 +35,9 @@ in rec {
     sudo umount -Rl ${mntRootVol}
     sudo rmdir ${mntRootVol}
     sudo vgchange -an ${ownLib.disk.volumeGroup diskId}
-    sudo cryptsetup close ${ownLib.disk.luksName diskId}
+    ${pkgs.lib.strings.optionalString encrypted ''
+      sudo cryptsetup close ${ownLib.disk.luksName diskId}
+    ''}
     sync
   '';
 
@@ -56,7 +61,7 @@ in rec {
     #!/usr/bin/env bash
     set -xe
 
-    read -p "Continue to format ${ownLib.disk.bootGrubDevice diskId} (YES/n)?" choice
+    read -p "Continue to format ${ownLib.disk.bootGrubDevice diskId} (YES/n)? " choice
     case "$choice" in
       YES ) echo "Continuing in 3 seconds..."; sleep 3;;
       n|N ) echo "Exiting..."; exit 0;;
@@ -100,12 +105,14 @@ in rec {
 
     sleep 1
 
-    # Encrypt
-    sudo cryptsetup luksFormat ${ownLib.disk.bootLuksDevice diskId} -
-    sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+    ${pkgs.lib.strings.optionalString encrypted ''
+      # Encrypt
+      sudo cryptsetup luksFormat ${ownLib.disk.bootLuksDevice diskId} -
+      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+    ''}
 
     # LVM
-    sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${ownLib.disk.luksPhysicalVolume diskId}
+    sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${ownLib.disk.lvmPv diskId encrypted}
     sudo lvcreate ${ownLib.disk.volumeGroup diskId} -L 2G -n swap
     sudo lvcreate ${ownLib.disk.volumeGroup diskId} -l 100%FREE -n root
 
@@ -160,7 +167,9 @@ in rec {
 
 
     if test "${previousDiskId}"; then
-      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+      ${pkgs.lib.strings.optionalString encrypted ''
+        sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+      ''}
       sync
       sleep 1
       if sudo vgs ${previousDiskId}; then
@@ -168,6 +177,8 @@ in rec {
         sudo vgscan
       fi
     fi
-    sudo cryptsetup close ${ownLib.disk.luksName diskId}
+    ${pkgs.lib.strings.optionalString encrypted ''
+      sudo cryptsetup close ${ownLib.disk.luksName diskId}
+    ''}
   '';
 }

nix/os/devices/steveej-t14/configuration.nix

@@ -4,7 +4,7 @@
   imports = [
     ../../profiles/common/configuration.nix
     ../../profiles/graphical/configuration.nix
-    ../../modules/encryptedDisk.nix
+    ../../modules/opnionatedDisk.nix
 
     ./system.nix
     ./hw.nix

nix/os/devices/steveej-t14/hw.nix

@@ -20,6 +20,7 @@ in
   # TASK: new device
   hardware.encryptedDisk = {
     enable = true;
+    encrypted = true;
     diskId = "nvme-SKHynix_HFS001TD9TNI-L2B0B_CJ0AN89731030AV3Q";
   };
 

nix/os/devices/vmd32387.contaboserver.net/configuration.nix

@@ -5,7 +5,7 @@
   ];
   imports = [
     ../../profiles/common/configuration.nix
-    ../../modules/encryptedDisk.nix
+    ../../modules/opinionatedDisk.nix
 
     ./system.nix
     ./hw.nix

nix/os/devices/vmd32387.contaboserver.net/hw.nix

@@ -18,8 +18,9 @@ let
 in
 {
   # TASK: new device
-  hardware.encryptedDisk = {
+  hardware.opinionatedDisk = {
     enable = true;
+    encrypted = true;
     diskId = "scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
   };