{ standard = { disks ? [ "/dev/vda" ], name ? "primary", ... }: { # this is my standard partitioning scheme for my machines: an LUKS-encrypted # btrfs volume disko.devices = { disk = { ${builtins.trace name name} = { type = "disk"; device = builtins.elemAt disks 0; content = { type = "gpt"; partitions = { ESP = { label = "EFI"; name = "ESP"; size = "512M"; type = "EF00"; content = { type = "filesystem"; format = "vfat"; mountpoint = "/boot"; mountOptions = [ "defaults" ]; }; }; luks = { size = "100%"; content = { type = "luks"; name = "crypted"; extraOpenArgs = [ "--allow-discards" ]; # if you want to use the key for interactive login be sure there is no trailing newline # for example use `echo -n "password" > /tmp/secret.key` keyFile = "/tmp/secret.key"; # Interactive # settings.keyFile = "/tmp/password.key"; # additionalKeyFiles = ["/tmp/additionalSecret.key"]; content = { type = "btrfs"; extraArgs = [ "-f" ]; subvolumes = { "/root" = { mountpoint = "/"; mountOptions = [ "compress=zstd" "noatime" ]; }; "/home" = { mountpoint = "/home"; mountOptions = [ "compress=zstd" "noatime" ]; }; "/nix" = { mountpoint = "/nix"; mountOptions = [ "compress=zstd" "noatime" ]; }; }; }; }; }; }; }; }; }; }; }; unencrypted = { disks ? [ "/dev/vda" ], ... }: { disko.devices = { disk = { primary = { type = "disk"; device = builtins.elemAt disks 0; content = { type = "gpt"; partitions = { ESP = { label = "EFI"; name = "ESP"; size = "512M"; type = "EF00"; content = { type = "filesystem"; format = "vfat"; mountpoint = "/boot"; mountOptions = [ "defaults" ]; }; }; root = { size = "100%"; content = { type = "btrfs"; extraArgs = [ "-f" ]; subvolumes = { "/root" = { mountpoint = "/"; mountOptions = [ ]; }; "/home" = { mountpoint = "/home"; mountOptions = [ "compress=zstd" ]; }; "/nix" = { mountpoint = "/nix"; mountOptions = [ "compress=zstd" "noatime" ]; }; }; }; }; }; }; }; }; }; }; }