oddlama's personal web page and blog
There are thousands of options in NixOS, but as users, we usually only interact with a select few of them. Despite that, a huge amount of those options does influence the final result in some way. Have you ever wondered which of them were actually relevant for your specific system? If you are now asking yourself why you would need this information, think about what happens when you enable a random…
Have you setup automatic disk unlocking with TPM2 and systemd-cryptenroll or clevis ? Then chances are high that your disk can be decrypted by an attacker who just has brief physical access to your machine - with some preparation, 10 minutes will suffice. In this article we will explore how TPM2 based disk decryption works, and understand why many setups are vulnerable to a kind of filesystem…
Dealing with secret values in NixOS is probably one of the first obstacles you come across when managing a NixOS-based server. In case you are not entirely familiar with the problem, the main issue is that any values part of a configuration file will inevitably end up in the nix store under /nix/store/<hash>... , and all of these paths are world-readable. However, there are different kinds of…