some fixes

README.md

@@ -8,6 +8,7 @@ Personal NixOS configuration using the [den](https://github.com/vic/den) framewo
 |------------|----------------------|--------|
 | `desktop`  | Gaming + development | Nvidia |
 | `notebook` | Portable development | Intel  |
+| `work`     | Portable development | AMD + Nvidia (PRIME) |
 
 ## Prerequisites
 
@@ -43,6 +44,64 @@ just gc
 just diff
 ```
 
+## Installing on a new machine (notebook)
+
+Only the `notebook` host supports automated installation via the installer ISO.
+No hardware-specific preparation is needed beforehand — the installer detects the
+hardware automatically using `nixos-generate-config`.
+
+### 1. Build and flash the ISO
+
+The ISO embeds the flake at build time, so **all changes must be committed first**.
+
+```bash
+# Commit any pending changes — the ISO only includes git-tracked files
+git add -A && git commit -m "pre-install snapshot"
+
+just iso
+sudo dd if=result/iso/*.iso of=/dev/sdX bs=4M status=progress && sync
+```
+
+### 2. Boot and install
+
+Boot the ISO on the target machine. The installer logs in as root automatically.
+
+**If you need Wi-Fi**, the script will prompt you to connect via `nmtui` before proceeding.
+
+Run the installer:
+```bash
+nixos-install-host
+```
+
+The script will:
+1. Prompt to set up network (Wi-Fi via `nmtui` if needed)
+2. Ask which host to install (`notebook`)
+3. **Auto-detect hardware** with `nixos-generate-config` and inject the result into the flake
+4. Show available disks and confirm the target
+5. Ask for the age key (`keys.txt`) — copy it to a USB or provide the path manually
+6. Partition the disk with LUKS + btrfs via disko (prompts for LUKS passphrase)
+7. Run `nixos-install`
+8. Copy the flake (with detected hardware config) to `~/repos/nixos` on the new system
+
+### 3. Age key
+
+The age key used to encrypt `secrets/secrets.yaml` must be available during installation.
+Bring it on a USB drive — the installer will find it automatically at `/run/media/*/keys.txt`.
+
+### 4. After the first boot
+
+Commit the auto-detected hardware config so future ISO builds include it:
+
+```bash
+cd ~/repos/nixos
+git add modules/_hardware/notebook-hardware.nix
+git commit -m "add notebook hardware config"
+git push
+```
+
+> **Note:** GRUB will ask for the LUKS passphrase once during boot, and the initrd will ask
+> again to mount the root filesystem. This is expected behavior with `enableCryptodisk`.
+
 ## Secrets (SOPS + age)
 
 Secrets are stored encrypted in `secrets/secrets.yaml` and decrypted at boot by [sops-nix](https://github.com/Mic92/sops-nix).