Install NixOS with full-disk encryption on an old BIOS-only laptop with no UEFI support, like a ThinkPad X200

README.md

nixos-install-bios

NixOS uses Calamares as its graphical installer. If you attempt to install from a BIOS system with full-disk encryption, Calamares will encrypt your /boot folder within the same LUKS2 partition. Older bootloaders cannot handle this. Instead, a separate unencrypted /boot partition is needed. This script will launch the NixOS installer GUI with the correct partitioning scheme for legacy BIOS systems.

Usage

1. Boot into a NixOS graphical installer live USB.
2. Close the default installer.
3. Connect to the Internet.
4. Go to https://gist.github.com/panasenco in Firefox and find this gist.
5. Copy the contents of the script nixos-install-bios.bash.
6. Open a terminal window.
7. sudo su
8. Paste the script contents into the terminal.
9. Go through the installer steps. On the partitioning screen, choose 'Erase disk', 'Swap (with Hibernate)', and 'Encrypt system'. Keep the bootloader location in the Master Boot Record.

Troubleshooting

Blank screen with Nix logo on boot

If you boot and see the Nix version selector prompt, but it seems to be frozen on a blank screen, don't panic. Type in your decryption password after a few seconds and press Enter. This bug is caused by the graphics driver not loading before asking for the decryption password prompt. After your initial boot, try adding this to your configuration.nix:

# Force the i915 driver to load early in the boot process
boot.initrd.kernelModules = [ "i915" ];

Hibernate option grayed out

If hibernate is grayed out in your KDE Plasma install, you'll need to explicitly set boot.resumeDevice to the same device that's set for the swap in hardware-configuration.nix:

# Use the swap device to resume from hibernation
boot.resumeDevice = (lib.head config.swapDevices).device;

Note that resuming from hibernate will take a long time on an HDD and you'll be stuck in a black screen for a bit.

Closing the lid reboots the laptop

Your laptop might not support ACPI S3 suspend. If that's the case, try adding this in your configuration.nix:

# Suspend to idle instead of ACPI S3
boot.kernelParams = [ "mem_sleep_default=s2idle" ];

Note that this will suspend to idle, which will consume significantly more battery than suspend to RAM. Use hibernate if you need a battery-saving sleep.

The system is slow

Upgrade to 8GB DDR3 RAM (2x 4GB laptop form factor sticks). I used these.

Also upgrade to a 2.5" SSD. You'll need these 3D printed adapters to secure the SSD in the Thinkpad's hard drive bay. I got this one.

nixos-install-bios.bash

mkdir /tmp/calamares
cd /tmp/calamares
cp -r /nix/store/*calamares-nixos-extensions*/etc/calamares/* .
cp -r /nix/store/*calamares-nixos-extensions*/share/calamares/* .
cp -r /nix/store/*calamares-wrapped*/share/calamares/qml .
echo 'createHybridBootloaderLayout: true' >> modules/partition.conf
calamares -c /tmp/calamares