2014-05-05 18:58:51 +00:00
|
|
|
{ config, lib, ... }:
|
2014-04-26 21:26:23 +00:00
|
|
|
|
2014-05-05 18:58:51 +00:00
|
|
|
with lib;
|
2014-04-26 21:26:23 +00:00
|
|
|
|
|
|
|
let
|
2015-11-25 19:09:09 +00:00
|
|
|
fileSystems = config.system.build.fileSystems ++ config.swapDevices;
|
2014-04-26 21:26:23 +00:00
|
|
|
encDevs = filter (dev: dev.encrypted.enable) fileSystems;
|
|
|
|
keyedEncDevs = filter (dev: dev.encrypted.keyFile != null) encDevs;
|
2015-09-21 19:02:27 +00:00
|
|
|
keylessEncDevs = filter (dev: dev.encrypted.keyFile == null) encDevs;
|
2014-04-26 21:26:23 +00:00
|
|
|
anyEncrypted =
|
2021-01-25 06:57:48 +00:00
|
|
|
foldr (j: v: v || j.encrypted.enable) false encDevs;
|
2014-04-26 21:26:23 +00:00
|
|
|
|
|
|
|
encryptedFSOptions = {
|
|
|
|
|
2019-01-26 19:44:05 +00:00
|
|
|
options.encrypted = {
|
2014-04-26 21:26:23 +00:00
|
|
|
enable = mkOption {
|
|
|
|
default = false;
|
|
|
|
type = types.bool;
|
2022-07-19 13:05:45 +00:00
|
|
|
description = lib.mdDoc "The block device is backed by an encrypted one, adds this device as a initrd luks entry.";
|
2014-04-26 21:26:23 +00:00
|
|
|
};
|
|
|
|
|
2019-02-02 16:31:31 +00:00
|
|
|
blkDev = mkOption {
|
2014-04-26 21:26:23 +00:00
|
|
|
default = null;
|
|
|
|
example = "/dev/sda1";
|
2015-08-17 17:52:45 +00:00
|
|
|
type = types.nullOr types.str;
|
2022-07-19 13:05:45 +00:00
|
|
|
description = lib.mdDoc "Location of the backing encrypted device.";
|
2014-04-26 21:26:23 +00:00
|
|
|
};
|
|
|
|
|
2019-02-02 16:31:31 +00:00
|
|
|
label = mkOption {
|
2014-04-26 21:26:23 +00:00
|
|
|
default = null;
|
|
|
|
example = "rootfs";
|
2015-11-26 14:40:31 +00:00
|
|
|
type = types.nullOr types.str;
|
2022-07-19 13:05:45 +00:00
|
|
|
description = lib.mdDoc "Label of the unlocked encrypted device. Set `fileSystems.<name?>.device` to `/dev/mapper/<label>` to mount the unlocked device.";
|
2014-04-26 21:26:23 +00:00
|
|
|
};
|
|
|
|
|
2019-02-02 16:31:31 +00:00
|
|
|
keyFile = mkOption {
|
2014-04-26 21:26:23 +00:00
|
|
|
default = null;
|
2017-10-16 15:46:46 +00:00
|
|
|
example = "/mnt-root/root/.swapkey";
|
2015-08-17 17:52:45 +00:00
|
|
|
type = types.nullOr types.str;
|
2022-07-19 13:05:45 +00:00
|
|
|
description = lib.mdDoc ''
|
2020-07-27 00:05:21 +00:00
|
|
|
Path to a keyfile used to unlock the backing encrypted
|
|
|
|
device. At the time this keyfile is accessed, the
|
2022-07-19 13:05:45 +00:00
|
|
|
`neededForBoot` filesystems (see
|
|
|
|
`fileSystems.<name?>.neededForBoot`)
|
|
|
|
will have been mounted under `/mnt-root`,
|
2020-07-27 00:05:21 +00:00
|
|
|
so the keyfile path should usually start with "/mnt-root/".
|
|
|
|
'';
|
2014-04-26 21:26:23 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
in
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
options = {
|
|
|
|
fileSystems = mkOption {
|
2020-08-22 23:28:45 +00:00
|
|
|
type = with lib.types; attrsOf (submodule encryptedFSOptions);
|
2014-04-26 21:26:23 +00:00
|
|
|
};
|
|
|
|
swapDevices = mkOption {
|
2019-01-26 19:44:05 +00:00
|
|
|
type = with lib.types; listOf (submodule encryptedFSOptions);
|
2014-04-26 21:26:23 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
config = mkIf anyEncrypted {
|
2017-09-23 18:02:16 +00:00
|
|
|
assertions = map (dev: {
|
2017-09-24 22:45:52 +00:00
|
|
|
assertion = dev.encrypted.label != null;
|
2017-09-23 18:02:16 +00:00
|
|
|
message = ''
|
|
|
|
The filesystem for ${dev.mountPoint} has encrypted.enable set to true, but no encrypted.label set
|
|
|
|
'';
|
|
|
|
}) encDevs;
|
|
|
|
|
2014-04-26 21:26:23 +00:00
|
|
|
boot.initrd = {
|
|
|
|
luks = {
|
|
|
|
devices =
|
2020-07-27 00:05:21 +00:00
|
|
|
builtins.listToAttrs (map (dev: {
|
|
|
|
name = dev.encrypted.label;
|
|
|
|
value = { device = dev.encrypted.blkDev; };
|
|
|
|
}) keylessEncDevs);
|
2017-09-14 02:44:14 +00:00
|
|
|
forceLuksSupportInInitrd = true;
|
2014-04-26 21:26:23 +00:00
|
|
|
};
|
|
|
|
postMountCommands =
|
2020-07-27 00:05:21 +00:00
|
|
|
concatMapStrings (dev:
|
|
|
|
"cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n"
|
|
|
|
) keyedEncDevs;
|
2014-04-26 21:26:23 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
}
|