45 lines
917 B
Nix
45 lines
917 B
Nix
|
{pkgs, config, ...}:
|
||
|
|
|
||
|
|
with pkgs.lib;
|
||
|
|
|
||
|
|
let
|
||
|
|
luksRoot = config.boot.initrd.luksRoot;
|
||
|
|
in
|
||
|
|
{
|
||
|
|
|
||
|
|
options = {
|
||
|
|
|
||
|
|
boot.initrd.luksRoot = mkOption {
|
||
|
|
default = null;
|
||
|
|
example = "/dev/sda3";
|
||
|
|
description = '';
|
||
|
|
The device that should be decrypted using LUKS before trying to mount the
|
||
|
|
root partition. This works for both LVM-over-LUKS and LUKS-over-LVM setups.
|
||
|
|
|
||
|
|
Make sure that initrd has the crypto modules needed for decryption.
|
||
|
|
|
||
|
|
The decrypted device name is /dev/mapper/luksroot.
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
config = mkIf (luksRoot != null) {
|
||
|
|
|
||
|
|
boot.initrd.extraUtilsCommands = ''
|
||
|
|
cp -r ${pkgs.cryptsetup}/lib/* $out/lib/
|
||
|
|
cp -r ${pkgs.popt}/lib/* $out/lib
|
||
|
|
cp ${pkgs.cryptsetup}/sbin/* $out/bin
|
||
|
|
'';
|
||
|
|
|
||
|
|
boot.initrd.postDeviceCommands = ''
|
||
|
|
cryptsetup luksOpen ${luksRoot} luksroot
|
||
|
|
lvm vgscan
|
||
|
|
lvm vgchange -ay
|
||
|
|
'';
|
||
|
|
|
||
|
|
};
|
||
|
|
|
||
|
|
}
|