Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132{ config, lib, ... }:
with lib;
let fileSystems = config.system.build.fileSystems ++ config.swapDevices; encDevs = filter (dev: dev.encrypted.enable) fileSystems;
# With scripted initrd, devices with a keyFile have to be opened # late, after file systems are mounted, because that could be where # the keyFile is located. With systemd initrd, each individual # systemd-cryptsetup@ unit has RequiresMountsFor= to delay until all # the mount units for the key file are done; i.e. no special # treatment is needed. lateEncDevs = if config.boot.initrd.systemd.enable then { } else filter (dev: dev.encrypted.keyFile != null) encDevs; earlyEncDevs = if config.boot.initrd.systemd.enable then encDevs else filter (dev: dev.encrypted.keyFile == null) encDevs;
anyEncrypted = foldr (j: v: v || j.encrypted.enable) false encDevs;
encryptedFSOptions = {
options.encrypted = { enable = mkOption { default = false; type = types.bool; description = "The block device is backed by an encrypted one, adds this device as a initrd luks entry."; };
blkDev = mkOption { default = null; example = "/dev/sda1"; type = types.nullOr types.str; description = "Location of the backing encrypted device."; };
label = mkOption { default = null; example = "rootfs"; type = types.nullOr types.str; description = "Label of the unlocked encrypted device. Set `fileSystems.<name?>.device` to `/dev/mapper/<label>` to mount the unlocked device."; };
keyFile = mkOption { default = null; example = "/mnt-root/root/.swapkey"; type = types.nullOr types.str; description = '' Path to a keyfile used to unlock the backing encrypted device. When systemd stage 1 is not enabled, at the time this keyfile is accessed, the `neededForBoot` filesystems (see `utils.fsNeededForBoot`) will have been mounted under `/mnt-root`, so the keyfile path should usually start with "/mnt-root/". When systemd stage 1 is enabled, `fsNeededForBoot` file systems will be mounted as needed under `/sysroot`, and the keyfile will not be accessed until its requisite mounts are done. ''; }; }; };in
{
options = { fileSystems = mkOption { type = with lib.types; attrsOf (submodule encryptedFSOptions); }; swapDevices = mkOption { type = with lib.types; listOf (submodule encryptedFSOptions); }; };
config = mkIf anyEncrypted { assertions = concatMap (dev: [ { assertion = dev.encrypted.label != null; message = '' The filesystem for ${dev.mountPoint} has encrypted.enable set to true, but no encrypted.label set ''; } { assertion = config.boot.initrd.systemd.enable -> ( dev.encrypted.keyFile == null || !lib.any (x: lib.hasPrefix x dev.encrypted.keyFile) [ "/mnt-root" "$targetRoot" ] ); message = '' Bad use of '/mnt-root' or '$targetRoot` in 'keyFile'.
When 'boot.initrd.systemd.enable' is enabled, file systems are mounted at '/sysroot' instead of '/mnt-root'. ''; } ]) encDevs;
boot.initrd = { luks = { devices = builtins.listToAttrs ( map (dev: { name = dev.encrypted.label; value = { device = dev.encrypted.blkDev; inherit (dev.encrypted) keyFile; }; }) earlyEncDevs ); forceLuksSupportInInitrd = true; }; # TODO: systemd stage 1 postMountCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ( concatMapStrings ( dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n" ) lateEncDevs ); }; };}