Installing Asgard

This guide follows the NixOS manual's manual-installation procedure but uses the Asgard configuration from this flake instead of generating /etc/nixos with nixos-generate-config. The target is a UEFI machine that dual-boots Windows and uses the Limine boot loader. Secure Boot is turned on only after the first unsigned boot works.

The full step-by-step procedure, including every command, lives in INSTALL.md. This page explains the shape of the process and why it is split into stages.

1. Prepare the installerCopy Anchor Link

Boot the NixOS installation medium in UEFI mode, become root, enable time synchronisation, and confirm /sys/firmware/efi exists. Connect to the network with nmtui if needed.

2. Partition and mountCopy Anchor Link

Asgard expects one Btrfs filesystem with four subvolumes, mounted with zstd compression, plus the existing EFI System Partition:

Create a new Linux partition in free space, format only that partition as Btrfs, and reuse the Windows ESP. Limine can share it when it has enough space.

3. Fetch and adapt the configurationCopy Anchor Link

Clone the flake to /mnt/etc/nix-config so it is at /etc/nix-config after the first boot. Instead of running nixos-generate-config, edit hosts/nixos/asgard/hardware-configuration.nix and replace its Btrfs and ESP UUIDs with the values that blkid reports. Add any machine-specific boot requirements there, such as initrd modules, microcode, or encrypted volumes.

4. Validate, then install the first generationCopy Anchor Link

Run nix flake check and build nixosConfigurations.asgard.config.system.build.toplevel from the installer. Because the system enables the ca-derivations experimental feature, the installer's Nix process needs it too.

For the first installation, boot.loader.limine.secureBoot.enable must be false, and Secure Boot must stay disabled in the firmware. Install with nixos-install --flake /mnt/etc/nix-config#asgard, set the password for cbrst with nixos-enter, and reboot.

5. Check the first bootCopy Anchor Link

Before touching Secure Boot, confirm that:

• Limine starts NixOS.
• The Noctalia Greeter lists cbrst, and the password works.
• Niri starts as the session.
• Mod+Return opens Ghostty.
• Firefox and Neovim are available.

6. Enroll Secure Boot keysCopy Anchor Link

Secure Boot is a deliberate two-stage process, so an unsigned but working system always exists to fall back to.

1. Generate keys with sudo sbctl create-keys. They are stored in /var/lib/sbctl, outside the repository.
2. Reboot into the firmware and enter Secure Boot Setup Mode. If the firmware can do this without deleting the existing keys, use that option when dual-booting Windows.
3. Enroll the keys with sbctl enroll-keys --microsoft --firmware-builtin. --microsoft keeps Windows and Microsoft-signed option ROMs working, and --firmware-builtin keeps the firmware's own certificates. The EFI variables are made mutable with chattr -i for the enrollment and immutable again afterwards.

7. Enable signed LimineCopy Anchor Link

Set boot.loader.limine.secureBoot.enable = true (Asgard's checked-in value), run sudo nixos-rebuild switch --flake /etc/nix-config#asgard, enable Secure Boot in the firmware, and verify with bootctl status and sudo sbctl verify. The firmware should report Secure Boot enabled in user mode.

See Secure Boot for how the module and boot loader settings fit together.