blob: 3781e6b13b968f31b3379d13a3d7fd9d22413383 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
{pkgs, config, ...}:
with pkgs.lib;
let
luksRoot = config.boot.initrd.luksRoot;
in
{
options = {
boot.initrd.luksRoot = mkOption {
default = "";
example = "/dev/sda3";
description = '';
The device that should be decrypted using LUKS before trying to mount the
root partition. This works for both LVM-over-LUKS and LUKS-over-LVM setups.
Make sure that initrd has the crypto modules needed for decryption.
The decrypted device name is /dev/mapper/luksroot.
'';
};
};
config = mkIf (luksRoot != "") {
# copy the cryptsetup binary and it's dependencies
boot.initrd.extraUtilsCommands = ''
cp -pdv ${pkgs.cryptsetup}/sbin/cryptsetup $out/bin
# XXX: do we have a function that does this?
for lib in $(ldd $out/bin/cryptsetup |grep '=>' |grep /nix/store/ |cut -d' ' -f3); do
cp -pdvn $lib $out/lib
cp -pvn $(readlink -f $lib) $out/lib
done
'';
boot.initrd.extraUtilsCommandsTest = ''
$out/bin/cryptsetup --version
'';
boot.initrd.preLVMCommands = ''
# Wait for luksRoot to appear, e.g. if on a usb drive.
# XXX: copied and adapted from stage-1-init.sh - should be
# available as a function.
if ! test -e ${luksRoot}; then
echo -n "waiting for device ${luksRoot} to appear..."
for ((try = 0; try < 10; try++)); do
sleep 1
if test -e ${luksRoot}; then break; fi
echo -n "."
done
echo "ok"
fi
# open luksRoot and scan for logical volumes
cryptsetup luksOpen ${luksRoot} luksroot
'';
};
}
|