add treefmt and jupyter lab

AI_Data/Clan/getting-started/disk-encryption.md

@@ -0,0 +1,180 @@
+
+This guide provides an example setup for a single-disk ZFS system with native encryption, accessible for decryption remotely.
+
+!!! Warning
+    This configuration only applies to `systemd-boot` enabled systems and **requires** UEFI booting.
+
+
+Replace the highlighted lines with your own disk-id.
+You can find our your disk-id by executing:
+```bash
+lsblk --output NAME,ID-LINK,FSTYPE,SIZE,MOUNTPOINT
+```
+
+
+=== "**Single Disk**"
+    Below is the configuration for `disko.nix`
+    ```nix hl_lines="17 48"
+      --8<-- "docs/code-examples/disko-single-disk.nix"
+    ```
+
+
+
+=== "**Raid 1**"
+    Below is the configuration for `disko.nix`
+    ```nix hl_lines="17 48 49"
+      --8<-- "docs/code-examples/disko-raid.nix"
+    ```
+
+Below is the configuration for `initrd.nix`.
+Replace `<yourkey>` with your ssh public key.
+Replace `kernelModules` with the ethernet module loaded one on your target machine.
+```nix hl_lines="18 29"
+{config, pkgs, ...}:
+
+{
+
+  boot.initrd.systemd = {
+    enable = true;
+  };
+
+  # uncomment this if you want to be asked for the decryption password on login
+  #users.root.shell = "/bin/systemd-tty-ask-password-agent";
+
+  boot.initrd.network = {
+    enable = true;
+
+    ssh = {
+      enable = true;
+      port = 7172;
+      authorizedKeys = [ "<yourkey>" ];
+      hostKeys = [
+        "/var/lib/initrd-ssh-key"
+      ];
+    };
+  };
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+  ];
+
+  # Find out the required network card driver by running `lspci -k` on the target machine
+  boot.initrd.kernelModules = [ "r8169" ];
+}
+```
+
+
+### Step 1: Copying SSH Public Key
+
+Before starting the installation process, ensure that the SSH public key is copied to the NixOS installer.
+
+1. Copy your public SSH key to the installer, if it has not been copied already:
+
+```bash
+ssh-copy-id -o PreferredAuthentications=password -o PubkeyAuthentication=no root@nixos-installer.local
+```
+
+### Step 1.5: Prepare Secret Key and Clear Disk Data
+
+1. Access the installer using SSH:
+
+```bash
+ssh root@nixos-installer.local
+```
+
+2. Create a `secret.key` file in `/tmp` using `nano` or another text editor:
+
+```bash
+nano /tmp/secret.key
+```
+
+3. Discard the old disk partition data:
+
+```bash
+blkdiscard /dev/disk/by-id/nvme-eui.002538b931b59865
+```
+
+4. Run the `clan` machine installation with the following command:
+
+```bash
+clan machines install gchq-local --target-host root@nixos-installer --yes --no-reboot
+```
+
+### Step 2: ZFS Pool Import and System Installation
+
+1. SSH into the installer once again:
+
+```bash
+ssh root@nixos-installer.local
+```
+
+2. Perform the following commands on the remote installation environment:
+
+```bash
+zpool import zroot
+zfs set keylocation=prompt zroot/root
+zfs load-key zroot/root
+zfs set mountpoint=/mnt zroot/root/nixos
+mount /dev/nvme0n1p2 /mnt/boot
+```
+
+3. Disconnect from the SSH session:
+
+```bash
+CTRL+D
+```
+
+4. Securely copy your local `initrd_rsa_key` to the installer's `/mnt` directory:
+
+```bash
+scp ~/.ssh/initrd_rsa_key root@nixos-installer.local:/mnt/var/lib/initrd-ssh-key
+```
+
+5. SSH back into the installer:
+
+```bash
+ssh root@nixos-installer.local
+```
+
+6. Navigate to the `/mnt` directory, enter the `nixos-enter` environment, and then exit:
+
+```bash
+cd /mnt
+nixos-enter
+realpath /run/current-system
+exit
+```
+
+7. Run the `nixos-install` command with the appropriate system path `<SYS_PATH>`:
+
+```bash
+nixos-install --no-root-passwd --no-channel-copy --root /mnt --system <SYS_PATH>
+```
+
+8. After the installation process, unmount `/mnt/boot`, change the ZFS mountpoint, and reboot the system:
+
+```bash
+umount /mnt/boot
+cd /
+zfs set mountpoint=/ zroot/root/nixos
+reboot
+```
+
+9. Perform a hard reboot of the machine and remove the USB stick.
+
+### Step 3: Accessing the Initial Ramdisk (initrd) Environment
+
+1. SSH into the initrd environment using the `initrd_rsa_key` and provided port:
+
+```bash
+ssh -p 7172 root@192.168.178.141
+```
+
+2. Run the `systemd-tty-ask-password-agent` utility to query a password:
+
+```bash
+systemd-tty-ask-password-agent --query
+```
+
+After completing these steps, your NixOS should be successfully installed and ready for use.
+
+**Note:** Replace `root@nixos-installer.local` and `192.168.178.141` with the appropriate user and IP addresses for your setup. Also, adjust `<SYS_PATH>` to reflect the correct system path for your environment.