nixpkgs/modules/system/boot/luksroot.nix

45 lines
917 B
Nix
Raw Normal View History

{pkgs, config, ...}:
with pkgs.lib;
let
luksRoot = config.boot.initrd.luksRoot;
in
{
options = {
boot.initrd.luksRoot = mkOption {
default = null;
example = "/dev/sda3";
description = '';
The device that should be decrypted using LUKS before trying to mount the
root partition. This works for both LVM-over-LUKS and LUKS-over-LVM setups.
Make sure that initrd has the crypto modules needed for decryption.
The decrypted device name is /dev/mapper/luksroot.
'';
};
};
config = mkIf (luksRoot != null) {
boot.initrd.extraUtilsCommands = ''
cp -r ${pkgs.cryptsetup}/lib/* $out/lib/
cp -r ${pkgs.popt}/lib/* $out/lib
cp ${pkgs.cryptsetup}/sbin/* $out/bin
'';
boot.initrd.postDeviceCommands = ''
cryptsetup luksOpen ${luksRoot} luksroot
lvm vgscan
lvm vgchange -ay
'';
};
}