You can keep secure boot on, snow supports chained secure boot from debian's shim.
Copy the iso to a usb drive using your favorite tools:
sudo dd if=snow-something.iso of=/dev/sda bs=1M
Use btrfs for the filesystem. Other choices are far less tested.
Image options:
frostyard/snow -> standard desktop
frostyard/snowfield -> snow + linux-surface and mok enrollment
others: frostyard/cayo -> debian server
frostyard/snowdrift -> debian server with more (incus, docker)
MOK If you installed snowfield for the surface, the MOK password is "snowlinux". You should reboot into the mok manager and you'll need that password to enroll the key.
Choose full disk encryption and enter a strong passphrase. Don't forget to check "TPM Auto Unlock" or you'll be annoyed on every reboot
If you choose one of the server images, you can enter a root password during install. If you use a desktop image, this isn't displayed.
When installation completes, you should power off and remove the USB drive.
Snow's "First Setup" opens on first boot and runs you through setting locale, keyboard settings, hostname and creating your first user. It also installs several flatpaks that are required for the GNOME experience, since we don't use debian's older versions.
When it completes it shows a big logout button that will take you to the GDM login screen for your new user.
When logging in as your user for the first time you get a selection screen to pick which flatpaks to install for your user. If you're unsure, just pick them all, it's not a huge load and you can always remove them later.
Check for updates with nbc:
nbc update --check
Apply them:
sudo nbc update
System status:
nbc status
Enable automatic download of available updates:
sudo systemctl enable nbc-update-download.timer
You can see downloaded updates in nbc status
Apply downloaded updates with
sudo nbc update --local-image
or
sudo nbc update --auto
--auto will apply a locally downloaded update if one exists, or pull from ghcr if not.
Use homebrew to install most things. Including vs-code: ublue home brew tap
Use dev containers and/or distrobox for dev requirements that aren't installed in the image. (that's most everything)
Incus is available for containers and virtual machines if you have more fancy development requirements.
the ChairLift app is intended for day to day management, it currently supports some of the above, but not everything yet.
Specifically, ignore anything with bootc in the title.
Snow isn't terribly volatile, but nbc is an absolute baby in the world right now. Use deja dup or your other favorite
backup tools to take backups. Daily. Hourly. Whatever your risk tolerance is, double that to be safe. You've been warned.
nbc hasn't eaten any data of mine in several weeks, however there is a little risk while it's still being developed actively... This is because new versions of nbc are installed with the updated image, so old nbc is installing new nbc. That means any big changes in nbc have to be planned very carefully with a migration path to handle the two boots required to be fully updated.