try new approach

nix/machines/flake-outputs.nix

@@ -52,6 +52,20 @@ in
   nixosConfigurations."worldcoin-hil-munich-1" = hilConfig {
     hostname = "worldcoin-hil-munich-1";
   };
+
+  nixosConfigurations."liveusb" = inputs.nixpkgs.lib.nixosSystem rec {
+    system = "x86_64-linux";
+    specialArgs = {
+      pkgs = p.${system};
+      hostname = "liveusb";
+      modulesPath = "${inputs.nixpkgs}/nixos/modules";
+    };
+    modules = [
+      ./liveusb2.nix
+      # inputs.nixos-generators.nixosModules.all-formats
+    ];
+  };
+
   packages.x86_64-linux.liveusb = nixos-generators.nixosGenerate {
     system = "x86_64-linux";
     specialArgs = { hostname = "liveusb"; };

nix/machines/liveusb2.nix

@@ -0,0 +1,97 @@
+{ config, modulesPath, pkgs, ... }:
+let
+  username = "worldcoin";
+in
+{
+  imports = [
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+
+    # Provide an initial copy of the NixOS channel so that the user
+    # doesn't need to run "nix-channel --update" first.
+    # "${modulesPath}/installer/cd-dvd/channel.nix}"
+  ];
+
+  nix = {
+    package = pkgs.nix;
+    settings = {
+      "experimental-features" = [ "nix-command" "flakes" "repl-flake" ];
+      "max-jobs" = "auto";
+      trusted-users = [
+        "root"
+        "@wheel"
+        username
+      ];
+    };
+  };
+  nixpkgs.config.allowUnfree = true;
+
+  # use the latest Linux kernel
+  boot = {
+    kernelPackages = pkgs.linuxPackages_latest;
+  };
+
+
+  # users.groups = {
+  #   plugdev = { };
+  # };
+  # users.users."${username}" = {
+  #   isNormalUser = true;
+  #   description = "${username}";
+  #   extraGroups = [
+  #     "dialout" # serial access
+  #     "networkmanager" # wifi control
+  #     "plugdev" # usb access
+  #     "wheel" # sudo powers
+  #   ];
+  #   openssh.authorizedKeys.keys = [
+  #     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLmHbuCMFpOKYvzMOpTOF+iMX9rrY6Y0naarcbWUV8G [email protected]"
+  #     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEoVo3BKge5tQuYpDuWKJaypdpfUuw4cq3/BYRFNovtj [email protected]"
+  #     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIOhklnZHdjM0VD82Z1naZaoeM3Lr9dbrsM0r+J9sHqN alex@hq-small"
+  #   ];
+  #   # Check 1Password for access.
+  #   # Note: This hash is publicly visible. Don't expose the user of the liveusb
+  #   # to password based third party acces, (i.e. don't enable password based
+  #   # ssh).
+  #   # Also, do not reuse this pasword for anything that is actually security
+  #   # sensitive.
+  #   password = "publiclyknownpassword";
+  #
+  #   shell = pkgs.zsh;
+  #   packages = with pkgs; [ ];
+  # };
+  # users.mutableUsers = false;
+  security.sudo.wheelNeedsPassword = false;
+
+  programs.zsh.enable = true;
+  programs.nix-ld.enable = true;
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    passwordAuthentication = false;
+  };
+  # Automatically log in at the virtual consoles.
+  services.getty.autologinUser = username;
+
+  # USB stuff
+  services.udev = {
+    enable = true;
+    extraRules = ''
+      SUBSYSTEM=="usb", MODE="0660", GROUP="plugdev"
+    '';
+  };
+
+  environment.systemPackages = with pkgs; [
+    awscli2
+    curl
+    gh
+    neovim
+    parted
+    picocom
+    ripgrep
+    usbutils
+    vim
+    zellij
+  ];
+
+}