fixed network issue, fixed docker start issue

Config.in

@@ -0,0 +1,4 @@
+# nimux/Config.in
+menu "Nimux packages"
+  source "$BR2_EXTERNAL_NIMUX_PATH/package/python-xonsh/Config.in"
+endmenu

board/qemu/x86_64/linux.config

@@ -10,7 +10,6 @@ CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
 CONFIG_CGROUP_SCHED=y
 CONFIG_CFS_BANDWIDTH=y
-CONFIG_RT_GROUP_SCHED=y
 CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_RDMA=y
 CONFIG_CGROUP_FREEZER=y
@@ -26,54 +25,99 @@ CONFIG_SMP=y
 CONFIG_HYPERVISOR_GUEST=y
 CONFIG_PARAVIRT=y
 CONFIG_PARAVIRT_SPINLOCKS=y
+# CONFIG_X86_MCE_AMD is not set
+CONFIG_X86_CPUID=y
+CONFIG_EFI=y
+CONFIG_EFI_STUB=y
+CONFIG_ACPI_DOCK=y
+CONFIG_INTEL_IDLE=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=y
 CONFIG_INET=y
 CONFIG_NETFILTER=y
 CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_PROCFS=y
+CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
 CONFIG_IP_NF_IPTABLES=y
 CONFIG_IP_NF_FILTER=y
 CONFIG_IP_NF_NAT=y
 CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_IP_NF_MANGLE=y
 CONFIG_IP_NF_RAW=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_NAT=y
+CONFIG_IP6_NF_TARGET_MASQUERADE=y
 CONFIG_BRIDGE=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_FQ_CODEL=y
+CONFIG_CGROUP_NET_PRIO=y
+CONFIG_CGROUP_NET_CLASSID=y
 # CONFIG_WIRELESS is not set
 CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_REALLOC_ENABLE_AUTO=y
+CONFIG_PCI_IOV=y
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMI_SYSFS=y
 CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_DRBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=1
 CONFIG_VIRTIO_BLK=y
-CONFIG_BLK_DEV_RBD=m
+CONFIG_BLK_DEV_RBD=y
 CONFIG_BLK_DEV_NVME=y
+CONFIG_NVME_MULTIPATH=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
 CONFIG_ATA_PIIX=y
+CONFIG_MD=y
 CONFIG_NETDEVICES=y
+CONFIG_DUMMY=y
+CONFIG_TUN=y
 CONFIG_VETH=y
 CONFIG_VIRTIO_NET=y
+CONFIG_E1000E=y
+CONFIG_IGB=y
+CONFIG_IGC=y
 CONFIG_NE2K_PCI=y
 CONFIG_8139CP=y
+CONFIG_PHYLIB=y
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_SENSORS_CORETEMP=y
+CONFIG_INTEL_POWERCLAMP=y
+CONFIG_INTEL_PCH_THERMAL=y
 CONFIG_DRM=y
+CONFIG_DRM_I915=y
 CONFIG_DRM_QXL=y
 CONFIG_DRM_VIRTIO_GPU=y
 CONFIG_DRM_BOCHS=y
+CONFIG_FB=y
+CONFIG_FB_EFI=y
+CONFIG_FB_SIMPLE=y
+CONFIG_DUMMY_CONSOLE_COLUMNS=120
+CONFIG_DUMMY_CONSOLE_ROWS=50
+CONFIG_LOGO=y
 CONFIG_SOUND=y
 CONFIG_SND=y
 CONFIG_SND_HDA_INTEL=y
@@ -89,15 +133,20 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
 CONFIG_EXT4_FS=y
+CONFIG_AUTOFS_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_OVERLAY_FS=y
+# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set
 CONFIG_OVERLAY_FS_INDEX=y
 CONFIG_OVERLAY_FS_XINO_AUTO=y
 CONFIG_OVERLAY_FS_METACOPY=y
-CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_EFIVAR_FS=y
 CONFIG_SQUASHFS=y
 CONFIG_SQUASHFS_XATTR=y
 CONFIG_CRYPTO_DEFLATE=y
+CONFIG_DEBUG_FS=y
 CONFIG_UNWINDER_FRAME_POINTER=y
+CONFIG_X86_MSR=y
+CONFIG_CPU_FREQ_STAT=y
 

board/qemu/x86_64/post-build.sh

@@ -1,11 +1,21 @@
 #!/bin/sh
-
-set -u
 set -e
 
-# Add a console on tty1
+# echo "[nimux] Enabling getty on tty1 (graphical) and ttyS0 (serial)..."
-if [ -e ${TARGET_DIR}/etc/inittab ]; then
+
-    grep -qE '^tty1::' ${TARGET_DIR}/etc/inittab || \
+# # Ensure target directories exist
-	sed -i '/GENERIC_SERIAL/a\
+# mkdir -p "${TARGET_DIR}/etc/systemd/system/getty.target.wants"
-tty1::respawn:/sbin/getty -L  tty1 0 vt100 # QEMU graphical window' ${TARGET_DIR}/etc/inittab
+
-fi
+# # Create or refresh symlinks for tty1 and ttyS0 getty services
+# ln -sf /usr/lib/systemd/system/getty@.service \
+#     "${TARGET_DIR}/etc/systemd/system/getty.target.wants/getty@tty1.service"
+
+# ln -sf /usr/lib/systemd/system/getty@.service \
+#     "${TARGET_DIR}/etc/systemd/system/getty.target.wants/getty@ttyS0.service"
+
+# # Optional: also ensure getty.target is enabled (some minimal setups need this)
+# mkdir -p "${TARGET_DIR}/etc/systemd/system/multi-user.target.wants"
+# ln -sf /usr/lib/systemd/system/getty.target \
+#     "${TARGET_DIR}/etc/systemd/system/multi-user.target.wants/getty.target"
+
+# echo "[nimux] Getty services linked successfully."

configs/nimux_x86_defconfig

@@ -1,60 +1,59 @@
 BR2_x86_64=y
 BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_6_12=y
+BR2_TOOLCHAIN_BUILDROOT_CXX=y
 BR2_GLOBAL_PATCH_DIR="board/qemu/patches"
-#BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_NIMUX_PATH)/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_RELRO_PARTIAL=y
 BR2_FORTIFY_SOURCE_2=y
 BR2_TARGET_GENERIC_HOSTNAME="nimux"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Nimux!"
 BR2_TARGET_GENERIC_PASSWD_SHA512=y
-BR2_TARGET_ROOTFS_CPIO=y
+BR2_INIT_SYSTEMD=y
-BR2_TARGET_ROOTFS_CPIO_GZIP=y
+BR2_INIT_SYSTEMD_VAR_NONE=y
-BR2_TARGET_ENABLE_ROOT_LOGIN=y
 BR2_TARGET_GENERIC_ROOT_PASSWD="hellotux"
-BR2_TARGET_ROOTFS_INITRAMFS=y
-BR2_TARGET_ROOTFS_ISO9660=y
-BR2_TARGET_ROOTFS_ISO9660_ISOLINUX=y
-BR2_TARGET_SYSLINUX=y
-BR2_TARGET_SYSLINUX_LEGACY_BIOS=y
-BR2_TARGET_SYSLINUX_ISOLINUX=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_SYSTEM_BIN_SH_BASH=y
-BR2_SYSTEM_BIN_SH="bash"
+# BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_SYSTEM_DHCP="eth0"
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
 BR2_ENABLE_LOCALE_WHITELIST="C C.UTF-8 en_US en_US.UTF-8"
 BR2_GENERATE_LOCALE="C en_US"
-BR2_TARGET_TZ_INFO=y
 BR2_TARGET_LOCALTIME="Europe/Amsterdam"
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_NIMUX_PATH)/rootfs-overlay"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh"
+BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_DEFCONFIG)"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.27"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_NIMUX_PATH)/board/qemu/x86_64/linux.config"
-#BR2_LINUX_KERNEL_XZ=y
-#BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_LINUX_TOOLS_CPUPOWER=y
-#BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_NIMUX_PATH)/board/pc/busybox.config"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
 BR2_PACKAGE_SQUASHFS=y
-BR2_PACKAGE_SQUASHFS_GZIP=y
-BR2_PACKAGE_SSHFS=y
 BR2_PACKAGE_ZFS=y
 BR2_PACKAGE_ACPID=y
-BR2_PACKAGE_EUDEV_RULES_GEN=y
+BR2_PACKAGE_ACPITOOL=y
+BR2_PACKAGE_HDDTEMP=y
 BR2_PACKAGE_HDPARM=y
-BR2_PACKAGE_HWDATA=y
 BR2_PACKAGE_HWDATA_IAB_OUI_TXT=y
+BR2_PACKAGE_LM_SENSORS=y
+BR2_PACKAGE_LM_SENSORS_FANCONTROL=y
+BR2_PACKAGE_LM_SENSORS_PWMCONFIG=y
+BR2_PACKAGE_LSHW=y
+BR2_PACKAGE_MHZ=y
+BR2_PACKAGE_NVME=y
+BR2_PACKAGE_POWERTOP=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_SETUPTOOLS=y
 BR2_PACKAGE_CA_CERTIFICATES=y
-BR2_PACKAGE_LIBCURL=y
 BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_LIBCAP=y
+BR2_PACKAGE_LIBGLIB2=y
 BR2_PACKAGE_BRIDGE_UTILS=y
 BR2_PACKAGE_IFTOP=y
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_NTP=y
-BR2_PACKAGE_NANO=y
+BR2_PACKAGE_OPENSSH=y
-BR2_PACKAGE_NANO_TINY=n
+BR2_PACKAGE_RSYNC=y
-BR2_PACKAGE_BASH=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_INOTIFY_TOOLS=y
 BR2_PACKAGE_SUDO=y
@@ -62,12 +61,12 @@ BR2_PACKAGE_CPULOAD=y
 BR2_PACKAGE_DOCKER_CLI=y
 BR2_PACKAGE_DOCKER_COMPOSE=y
 BR2_PACKAGE_DOCKER_ENGINE=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_DOCKER_ENGINE_DOCKER_INIT_CATATONIT=y
-BR2_SYSTEM_DHCP="eth0"
+BR2_PACKAGE_SYSTEMD_BOOT=y
-BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh"
+BR2_PACKAGE_SYSTEMD_ANALYZE=y
-#BR2_ROOTFS_POST_IMAGE_SCRIPT="board/qemu/post-image.sh"
+BR2_PACKAGE_SYSTEMD_LOGIND=y
-BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_DEFCONFIG)"
+BR2_PACKAGE_NANO=y
-# BR2_TARGET_ROOTFS_EXT2=y
+# BR2_PACKAGE_NANO_TINY is not set
+BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
-BR2_PACKAGE_HOST_QEMU=y
+BR2_PACKAGE_PYTHON_XONSH=y
-BR2_PACKAGE_HOST_QEMU_SYSTEM_MODE=y

external.desc

@@ -1,2 +1,2 @@
 name: NIMUX
-desc: The custom buildroot overlay for nimux
+desc: Nimux is the imutable lightweigth HomeLab OS with docker in its core

external.mk

@@ -1 +1,3 @@
 include $(sort $(wildcard $(BR2_EXTERNAL_NIMUX_PATH)/package/*/*.mk))
+
+BR2_ROOTFS_POST_BUILD_SCRIPT += $(BR2_EXTERNAL_NIMUX_PATH)/board/qemu/x86_64/post-build.sh

rootfs-overlay/etc/fstab

@@ -5,6 +5,6 @@ tmpfs            /dev/shm                tmpfs    nosuid,nodev,mode=0777
 tmpfs            /tmp                    tmpfs    nosuid,nodev,mode=1777                              0       0
 tmpfs            /run                    tmpfs    nosuid,nodev,mode=0755                              0       0
 tmpfs            /mnt                    tmpfs    nosuid,nodev,mode=0755                              0       0
-tmpfs            /var/log                tmpfs    nosuid,nodev,mode=0775                              0       0
+tmpfs            /root                   tmpfs    nosuid,nodev,mode=0755                              0       0
 sysfs            /sys                    sysfs    defaults,nosuid,nodev,noexec                        0       0
 cgroup2          /sys/fs/cgroup          cgroup2  defaults,nosuid,nodev,noexec                        0       0

rootfs-overlay/etc/systemd/network/10-dhcp-all.network

@@ -0,0 +1,12 @@
+[Match]
+# Match all real Ethernet interfaces
+Type=ether
+# Prevent virtual devices to match (e.g. docker0 and veth should be left alone)
+Name=en* eth*
+
+[Network]
+DHCP=yes
+IPv6AcceptRA=yes
+
+[DHCP]
+UseDNS=yes

rootfs-overlay/etc/systemd/resolved.conf

@@ -0,0 +1,3 @@
+[Resolve]
+DNSSEC=no
+DNSOverTLS=no

rootfs-overlay/usr/lib/nimux/create-zfs.xsh

@@ -0,0 +1,9 @@
+#!/bin/xonsh --no-rc
+zpool create -o ashift=12 -O normalization=formD -O xattr=sa \
+             -O atime=off -O acltype=posix -O mountpoint=none nimux-zfs mirror /dev/vda /dev/vdb
+zfs create -o mountpoint=/mnt/data nimux-zfs/data
+zfs create -o mountpoint=/var/lib/docker nimux-zfs/docker
+zfs create -o mountpoint=/var/lib/docker/volumes -o compression=zstd nimux-zfs/docker/volumes
+zfs create -o mountpoint=none nimux-zfs/root
+zfs create -o mountpoint=/run/nimux/overlay/etc/persist nimux-zfs/root/etc
+zfs create -o mountpoint=/home nimux-zfs/root/home

rootfs-overlay/usr/lib/nimux/nimux-early-mount.xsh

@@ -0,0 +1,23 @@
+#!/bin/xonsh --no-rc
+# Nimux Early Mount (xonsh)
+
+# #mount /mnt
+# print("mount /mnt")
+# /bin/mount /mnt
+
+# # mount root on future accesable place
+# print("re-mount rootfs")
+# /bin/mkdir -p /mnt/rootfs
+# /bin/mount --bind / /mnt/rootfs
+# /bin/mount --make-rprivate /mnt/rootfs/
+
+# # import zpool
+# print("import zpool")
+# /sbin/zpool import nimux-zfs
+
+# # overlay etc and home with a persistant zfs dataset
+# print("overlay mount etc")
+# /bin/unionfs -o cow,nonempty /mnt/rootfs.overlay/etc=RW:/mnt/rootfs/etc=RO /etc
+# print("overlay mount home")
+# /bin/unionfs -o cow,nonempty /mnt/rootfs.overlay/home=RW:/mnt/rootfs/home=RO /home
+

rootfs-overlay/usr/lib/nimux/nimux-firstlogin

@@ -0,0 +1,383 @@
+# /etc/profile.d/nimux-first-login.sh
+# Nimux first-login bootstrap (mirror) — numbered disk selection + safeguards + default proposal
+
+case $- in *i*) ;; *) return 0 ;; esac
+
+SENTINEL="/var/lib/nimux/firstboot.done"
+[ -f "$SENTINEL" ] && return 0
+
+run_bootstrap() {
+  set -euo pipefail
+
+  need() { command -v "$1" >/dev/null 2>&1 || { echo "Missing: $1"; exit 1; }; }
+  need zpool; need zfs; need lsblk; command -v blkid >/dev/null 2>&1 || true; command -v blockdev >/dev/null 2>&1 || true
+
+  CUR_HOST="$(hostname)"
+  POOL="${CUR_HOST}-zfs"
+  FSTAB="/etc/fstab"
+  OVERLAY_ROOT="/mnt/overlays/root"
+  ADMINUSER=""
+  NEW_LANG="${LANG:-en_US.UTF-8}"
+  DISK1=""; DISK2=""
+  DEFAULT_IDX1=""; DEFAULT_IDX2=""
+
+  # -------------------- Helpers --------------------
+
+  canonical() { readlink -f "$1"; }
+
+  has_partitions() {
+    # returns 0 (true) if the disk has child partitions
+    local d="$1"
+    lsblk -n "$d" -o TYPE | grep -q '^part$'
+  }
+
+  fstype_of() {
+    # Try lsblk first, then blkid
+    local d="$1" fs
+    fs="$(lsblk -dn -o FSTYPE "$d" 2>/dev/null | tr -d ' ')"
+    if [ -z "$fs" ] && command -v blkid >/dev/null 2>&1; then
+      fs="$(blkid -o value -s TYPE "$d" 2>/dev/null | tr -d ' ')"
+    fi
+    echo "${fs:-}"
+  }
+
+  bytes_of() {
+    # size in bytes (fallback to lsblk if blockdev not present)
+    local d="$1"
+    if command -v blockdev >/dev/null 2>&1; then
+      blockdev --getsize64 "$d" 2>/dev/null || echo 0
+    else
+      lsblk -bdn -o SIZE "$d" 2>/dev/null || echo 0
+    fi
+  }
+
+  is_whole_disk() {
+    # TYPE=disk
+    local d="$1"
+    [ "$(lsblk -dn -o TYPE "$d" 2>/dev/null)" = "disk" ]
+  }
+
+  is_zfs_member() {
+    local d="$1"
+    [ "$(fstype_of "$d")" = "zfs_member" ]
+  }
+
+  print_disks_table() {
+    echo "Available whole disks:"
+    printf "  %-5s %-20s %-12s %-12s %s\n" "No." "PATH" "SIZE" "FSTYPE" "MODEL"
+    local i=1
+    while read -r name size type fstype model; do
+      [ "$type" = "disk" ] || continue
+      local path="/dev/$name"
+      local sz="$size"
+      printf "  [%d]   %-20s %-12s %-12s %s\n" "$i" "$path" "$sz" "${fstype:--}" "${model:-"-"}"
+      i=$((i+1))
+    done < <(lsblk -dn -o NAME,SIZE,TYPE,FSTYPE,MODEL)
+  }
+
+  build_disk_arrays() {
+    # Build arrays for selection UI
+    mapfile -t DISK_LINES < <(lsblk -dn -o NAME,SIZE,TYPE,FSTYPE,MODEL | awk '$3=="disk"{print}')
+    mapfile -t DISK_PATHS < <(printf "%s\n" "${DISK_LINES[@]}" | awk '{print "/dev/"$1}')
+    [ "${#DISK_PATHS[@]}" -ge 1 ] || { echo "No whole disks found."; exit 1; }
+  }
+
+  propose_two_largest_empty() {
+    # Choose two largest disks that are: TYPE=disk, no partitions, no FSTYPE, not zfs_member
+    local candidates=()
+    local sizes=()
+
+    for p in "${DISK_PATHS[@]}"; do
+      is_whole_disk "$p" || continue
+      if has_partitions "$p"; then continue; fi
+      local fs; fs="$(fstype_of "$p")"
+      [ -n "$fs" ] && continue
+      is_zfs_member "$p" && continue
+      local b; b="$(bytes_of "$p")"
+      candidates+=("$p"); sizes+=("$b")
+    done
+
+    if [ "${#candidates[@]}" -lt 2 ]; then
+      # Not enough clean disks to propose
+      DEFAULT_IDX1=""; DEFAULT_IDX2=""
+      return 0
+    fi
+
+    # Sort candidates by size desc (simple bubble for small lists)
+    local idxs=()
+    local i; for ((i=0;i<${#candidates[@]};i++)); do idxs+=("$i"); done
+    local swapped=1 j tmp
+    while [ $swapped -eq 1 ]; do
+      swapped=0
+      for ((j=0;j<${#idxs[@]}-1;j++)); do
+        if [ "${sizes[${idxs[$j]}]}" -lt "${sizes[${idxs[$j+1]}]}" ]; then
+          tmp="${idxs[$j]}"; idxs[$j]="${idxs[$j+1]}"; idxs[$j+1]="$tmp"; swapped=1
+        fi
+      done
+    done
+
+    local top1="${candidates[${idxs[0]}]}"
+    local top2="${candidates[${idxs[1]}]}"
+
+    # Map to numbered list indices shown to user
+    local n i=1
+    for n in "${DISK_PATHS[@]}"; do
+      if [ "$(canonical "$n")" = "$(canonical "$top1")" ]; then DEFAULT_IDX1="$i"; fi
+      if [ "$(canonical "$n")" = "$(canonical "$top2")" ]; then DEFAULT_IDX2="$i"; fi
+      i=$((i+1))
+    done
+  }
+
+  warn_if_risky() {
+    # Return 0 if OK; non-zero if user declines risk
+    local d="$1" label="$2"
+    local risk=0 msg=""
+    if has_partitions "$d"; then risk=1; msg+="\n - $label has existing partitions"; fi
+    local fs; fs="$(fstype_of "$d")"
+    if [ -n "$fs" ]; then risk=1; msg+="\n - $label has existing filesystem: $fs"; fi
+    if [ "$risk" -eq 0 ]; then return 0; fi
+    echo -e "WARNING:$msg"
+    read -r -p "Type 'force' to override and continue with $label: " force
+    [ "${force:-}" = "force" ] || { echo "Refusing risky selection for $label."; return 1; }
+    return 0
+  }
+
+  pick_two_disks() {
+    echo
+    print_disks_table
+    build_disk_arrays
+    propose_two_largest_empty
+
+    local default_hint=""
+    if [ -n "$DEFAULT_IDX1" ] && [ -n "$DEFAULT_IDX2" ]; then
+      default_hint=" [${DEFAULT_IDX1} ${DEFAULT_IDX2}]"
+      echo
+      echo "Proposed (largest clean disks): ${DEFAULT_IDX1} and ${DEFAULT_IDX2}"
+      echo "Press Enter to accept, or type two numbers to override."
+    fi
+
+    while :; do
+      echo
+      read -r -p "Select TWO disks by number (e.g. '1 3')${default_hint}: " CHOICE
+      if [ -z "${CHOICE// }" ] && [ -n "$DEFAULT_IDX1" ] && [ -n "$DEFAULT_IDX2" ]; then
+        idx1="$DEFAULT_IDX1"; idx2="$DEFAULT_IDX2"
+      else
+        CHOICE="$(echo "$CHOICE" | tr ',' ' ' | xargs)"
+        set +e; set -- $CHOICE; set -e
+        if [ $# -ne 2 ]; then echo "Please provide exactly two numbers."; continue; fi
+        idx1="$1"; idx2="$2"
+      fi
+
+      case "$idx1" in (*[!0-9]*|'') echo "Invalid first selection."; continue;; esac
+      case "$idx2" in (*[!0-9]*|'') echo "Invalid second selection."; continue;; esac
+      [ "$idx1" -ge 1 ] && [ "$idx1" -le "${#DISK_PATHS[@]}" ] || { echo "First number out of range."; continue; }
+      [ "$idx2" -ge 1 ] && [ "$idx2" -le "${#DISK_PATHS[@]}" ] || { echo "Second number out of range."; continue; }
+      [ "$idx1" -ne "$idx2" ] || { echo "Disks must be different."; continue; }
+
+      local cand1="${DISK_PATHS[$((idx1-1))]}"
+      local cand2="${DISK_PATHS[$((idx2-1))]}"
+
+      # Risk checks
+      warn_if_risky "$cand1" "Disk 1" || continue
+      warn_if_risky "$cand2" "Disk 2" || continue
+
+      DISK1="$cand1"; DISK2="$cand2"
+      echo
+      echo "Selected:"
+      echo "  Disk 1: $DISK1"
+      echo "  Disk 2: $DISK2"
+      read -r -p "Proceed to create MIRRORED pool on these disks? [y/N]: " yn
+      case "${yn:-N}" in y|Y) break;; *) echo "Re-selecting…";; esac
+    done
+  }
+
+  create_pool_and_datasets() {
+    echo
+    echo "== Creating mirrored ZFS pool and datasets =="
+    if zpool list -H -o name 2>/dev/null | grep -qx "$POOL"; then
+      echo "Pool '$POOL' already exists; skipping creation."
+    else
+      ASHIFT="12"
+      zpool create -f \
+        -o ashift="$ASHIFT" \
+        -O compression=zstd -O atime=off -O xattr=sa -O acltype=posixacl \
+        "$POOL" mirror "$DISK1" "$DISK2"
+    fi
+
+    zfs set mountpoint=none "$POOL" || true
+
+    create_ds() {  # $1=dataset $2=mountpoint|"none"
+      local ds="$1" mp="$2"
+      if ! zfs list -H -o name | grep -qx "$ds"; then
+        if [ "$mp" = "none" ]; then
+          zfs create -o mountpoint=none "$ds"
+        else
+          zfs create -o mountpoint="$mp" "$ds"
+        fi
+      else
+        [ "$mp" = "none" ] && zfs set mountpoint=none "$ds" || zfs set mountpoint="$mp" "$ds"
+      fi
+    }
+
+    create_ds "${POOL}"                         "none"
+    create_ds "${POOL}/data"                    "/mnt/data"
+    create_ds "${POOL}/docker"                  "/var/lib/docker"
+    create_ds "${POOL}/overlay-layers"          "none"
+    create_ds "${POOL}/overlay-layers/root"     "$OVERLAY_ROOT"
+
+    mkdir -p /mnt/data /var/lib/docker "$OVERLAY_ROOT"
+    zfs mount -a
+  }
+
+  setup_overlays() {
+    echo
+    echo "== Setting up overlays for /etc and /home =="
+    mkdir -p "${OVERLAY_ROOT}/etc" "${OVERLAY_ROOT}/etc.work" \
+             "${OVERLAY_ROOT}/home" "${OVERLAY_ROOT}/home.work"
+    chmod 700 "${OVERLAY_ROOT}/etc.work" "${OVERLAY_ROOT}/home.work"
+    touch "$FSTAB"
+
+    add_fstab_line() { local line="$1" pattern="$2"; grep -qsE "$pattern" "$FSTAB" || echo "$line" >> "$FSTAB"; }
+
+    add_fstab_line \
+      "ZFS=${POOL}/overlay-layers/root  $OVERLAY_ROOT  zfs  defaults,nofail  0  0" \
+      "^ZFS=${POOL}/overlay-layers/root[[:space:]]+$OVERLAY_ROOT[[:space:]]+zfs"
+
+    add_fstab_line \
+      "overlay  /etc   overlay  nofail,x-systemd.requires-mounts-for=$OVERLAY_ROOT,lowerdir=/etc,upperdir=${OVERLAY_ROOT}/etc,workdir=${OVERLAY_ROOT}/etc.work  0  0" \
+      "^overlay[[:space:]]+/etc[[:space:]]+overlay.*upperdir=${OVERLAY_ROOT}/etc,workdir=${OVERLAY_ROOT}/etc.work"
+
+    add_fstab_line \
+      "overlay  /home  overlay  nofail,x-systemd.requires-mounts-for=$OVERLAY_ROOT,lowerdir=/home,upperdir=${OVERLAY_ROOT}/home,workdir=${OVERLAY_ROOT}/home.work  0  0" \
+      "^overlay[[:space:]]+/home[[:space:]]+overlay.*upperdir=${OVERLAY_ROOT}/home,workdir=${OVERLAY_ROOT}/home.work"
+  }
+
+  ask_hostname_and_maybe_rename_pool() {
+    echo
+    echo "== Hostname =="
+    read -r -p "New hostname (leave blank to keep '$CUR_HOST'): " NEW_HOSTNAME
+    NEW_HOSTNAME="${NEW_HOSTNAME:-$CUR_HOST}"
+
+    if command -v hostnamectl >/dev/null 2>&1; then
+      hostnamectl set-hostname "$NEW_HOSTNAME"
+    else
+      echo "$NEW_HOSTNAME" > /etc/hostname
+    fi
+
+    local NEWPOOL="${NEW_HOSTNAME}-zfs"
+    if [ "$NEWPOOL" != "$POOL" ]; then
+      echo "Renaming pool '$POOL' -> '$NEWPOOL' via export/import…"
+      zfs unmount -a || true
+      sed -i "s/ZFS=${POOL}\//ZFS=${NEWPOOL}\//g" "$FSTAB"
+      zpool export "$POOL"
+      zpool import "$POOL" "$NEWPOOL"
+      zfs set mountpoint=none "$NEWPOOL" || true
+      zfs set mountpoint=/mnt/data            "$NEWPOOL/data" || true
+      zfs set mountpoint=/var/lib/docker      "$NEWPOOL/docker" || true
+      zfs set mountpoint=none                 "$NEWPOOL/overlay-layers" || true
+      zfs set mountpoint="$OVERLAY_ROOT"      "$NEWPOOL/overlay-layers/root" || true
+      zfs mount -a
+      POOL="$NEWPOOL"
+    fi
+  }
+
+  set_locale_step() {
+    echo
+    echo "== Locale =="
+    read -r -p "Locale (LANG) [${NEW_LANG}]: " LANG_INPUT
+    NEW_LANG="${LANG_INPUT:-$NEW_LANG}"
+    printf 'LANG=%s\n' "$NEW_LANG" > /etc/locale.conf
+    if command -v localectl >/dev/null 2>&1; then
+      localectl set-locale "LANG=$NEW_LANG" || true
+    fi
+  }
+
+  create_admin_user() {
+    echo
+    echo "== Create admin user with sudo rights =="
+    while :; do
+      read -r -p "Admin username (e.g., nimuxadmin): " ADMINUSER
+      [ -n "${ADMINUSER:-}" ] && break
+      echo "Username cannot be empty."
+    done
+
+    if id "$ADMINUSER" >/dev/null 2>&1; then
+      echo "User '$ADMINUSER' already exists."
+    else
+      if [ -x /bin/bash ]; then SHELLPATH=/bin/bash
+      elif [ -x /bin/sh ]; then SHELLPATH=/bin/sh
+      else SHELLPATH=/bin/sh; fi
+      useradd -m -s "$SHELLPATH" "$ADMINUSER"
+      echo "Set password for $ADMINUSER:"
+      passwd "$ADMINUSER"
+    fi
+
+    if command -v sudo >/dev/null 2>&1; then
+      getent group sudo >/dev/null 2>&1 || groupadd sudo
+      usermod -aG sudo "$ADMINUSER" || true
+      mkdir -p /etc/sudoers.d
+      SUDO_FILE="/etc/sudoers.d/90-${ADMINUSER}"
+      [ -f "$SUDO_FILE" ] || { echo "${ADMINUSER} ALL=(ALL) ALL" > "$SUDO_FILE"; chmod 440 "$SUDO_FILE"; }
+    else
+      echo "NOTE: 'sudo' not installed; grant temporary root via 'su' until sudo is available."
+    fi
+  }
+
+  disable_root_login() {
+    echo
+    echo "== Disable root logins =="
+    passwd -l root || true
+    if [ -f /etc/ssh/sshd_config ]; then
+      if grep -qE '^\s*PermitRootLogin\s+' /etc/ssh/sshd_config; then
+        sed -i 's/^\s*PermitRootLogin\s\+.*/PermitRootLogin no/' /etc/ssh/sshd_config
+      else
+        printf '\nPermitRootLogin no\n' >> /etc/ssh/sshd_config
+      fi
+      if grep -qE '^\s*PermitEmptyPasswords\s+' /etc/ssh/sshd_config'; then
+        sed -i 's/^\s*PermitEmptyPasswords\s\+.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config
+      else
+        printf 'PermitEmptyPasswords no\n' >> /etc/ssh/sshd_config
+      fi
+      (command -v systemctl >/dev/null 2>&1 && systemctl reload sshd) || \
+      (command -v rc-service >/dev/null 2>&1 && rc-service sshd reload) || true
+    fi
+  }
+
+  mark_completion() {
+    mkdir -p "$(dirname "$SENTINEL")"
+    echo "ok" > "$SENTINEL"
+    echo
+    echo "Bootstrap complete."
+    echo " - Pool: ${POOL}"
+    echo " - Overlays for /etc and /home will take effect on next reboot."
+    echo " - Locale: ${NEW_LANG}"
+    echo " - Admin user: ${ADMINUSER}"
+    echo " - Root login disabled"
+  }
+
+  # -------------------- Ordered flow --------------------
+  echo
+  echo "=== Nimux First-Login ==="
+  build_disk_arrays
+  pick_two_disks
+  create_pool_and_datasets
+  setup_overlays
+  ask_hostname_and_maybe_rename_pool
+  set_locale_step
+  create_admin_user
+  disable_root_login
+  mark_completion
+}
+
+if [ "$EUID" -ne 0 ]; then
+  echo
+  echo "[Nimux] First-boot setup needs elevated privileges. Re-running with sudo…"
+  echo
+  sudo bash -c "$(declare -f run_bootstrap); run_bootstrap" && \
+    echo "Setup completed (or already done)." || \
+    echo "Setup aborted or failed."
+else
+  run_bootstrap
+fi
+
+[ -f "$SENTINEL" ] && chmod -x /etc/profile.d/nimux-first-login.sh 2>/dev/null || true

rootfs-overlay/usr/lib/systemd/system/nimux-zfs-mount.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Nimux early mount: ZFS import + overlay for /etc and /home
+DefaultDependencies=no
+Before=sysinit.target
+Conflicts=shutdown.target
+Wants=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=XONSH_HISTORY_BACKEND=none
+Environment=XONSH_CACHE_DIR=/dev/null
+Environment=XONSH_DATA_DIR=/dev/null
+Environment=HOME=/tmp/xonsh-home
+ExecStart=/usr/lib/nimux/nimux-early-mount.xsh
+TimeoutStartSec=30s
+
+
+[Install]
+WantedBy=sysinit.target
+

rootfs-overlay/usr/sbin/init

@@ -0,0 +1,61 @@
+#!/bin/sh
+# Nimux pre-systemd boot
+
+export ROOT_DEV=/dev/ram0
+export RUN_NIMUX=/run/nimux
+export ROOTFS_ORIG=$RUN_NIMUX/rootfs.orig
+export NIMUX_OVERLAY=$RUN_NIMUX/overlay
+
+# create the minimal required mount
+/bin/echo "[init] Cmdline:" "$@"
+/bin/echo "[init] perform early mounts"
+/bin/mount -t proc proc /proc
+/bin/mount -t sysfs sysfs /sys
+/bin/mount -t devtmpfs devtmpfs /dev
+/bin/mount -t tmpfs tmpfs /run
+/bin/mount -t tmpfs tmpfs /mnt
+
+# mount root on a future accesable place
+/bin/echo "[init] re-mount rootfs"
+/bin/mkdir -p $ROOTFS_ORIG
+/bin/mount -t squashfs -o ro $ROOT_DEV $ROOTFS_ORIG
+/bin/mount --make-rprivate $ROOTFS_ORIG
+
+# overlay the /var directory with a volatile tmpfs
+/bin/echo "[init] overlay /var"
+export VAR_LOWER=$ROOTFS_ORIG/var
+export VAR_UPPER=$NIMUX_OVERLAY/var/upper
+export VAR_WORK=$NIMUX_OVERLAY/var/work
+
+/bin/mkdir -p $VAR_UPPER $VAR_WORK
+/bin/mount -t overlay overlay-var -o lowerdir=$VAR_LOWER,upperdir=$VAR_UPPER,workdir=$VAR_WORK /var
+
+# ovelay /etc and patch with persistant storage 
+# we don´t overlay on persistent storage, because this will cause bootfailures
+# when the lower dir (rootfs.squashfs) is updated by a future release of Numix
+/bin/echo "[init] overlay /etc"
+export ETC_LOWER=$ROOTFS_ORIG/etc
+export ETC_UPPER=$NIMUX_OVERLAY/etc/upper
+export ETC_WORK=$NIMUX_OVERLAY/etc/work
+
+/bin/mkdir -p $ETC_UPPER $ETC_WORK
+/bin/mount -t overlay overlay-etc -o lowerdir=$ETC_LOWER,upperdir=$ETC_UPPER,workdir=$ETC_WORK /etc
+
+# import zpool (this will also mount etc & home)
+/bin/echo "[init] import zpool"
+/sbin/zpool import nimux-zfs
+
+# update etc dir with persitent data
+export ETC_PERSIST=$NIMUX_OVERLAY/etc/persist
+/bin/echo "[init] update /etc with persistant data"
+/bin/echo "[init] /etc persist dir: " $ETC_PERSIST
+/bin/cp -R $ETC_PERSIST/* /etc
+
+# hand over to systemd
+/bin/echo "[init] handover control to systemd"
+exec /usr/lib/systemd/systemd
+
+# we shouldn´t get to here
+echo "[init] ERROR: switch_root failed!" >&2
+export PS1="\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\] (init-rescue)# "
+exec sh