diff options
author | Katharina Fey <kookie@spacekookie.de> | 2020-08-07 12:29:39 +0200 |
---|---|---|
committer | Katharina Fey <kookie@spacekookie.de> | 2020-08-07 12:29:39 +0200 |
commit | 5581b5521e14317c3507a6e8451a3f14996e5c4d (patch) | |
tree | 7aadee5a9ef5d6e2acc8929818c6eb2d2099e2ae /nixpkgs/nixos/modules/tasks/encrypted-devices.nix | |
parent | de94c6c62e2f86b3667386a42690d6bb376a2f58 (diff) | |
parent | 8e2b14aceb1d40c7e8b84c03a7c78955359872bb (diff) |
Merge commit '8e2b14aceb1d40c7e8b84c03a7c78955359872bb'
Diffstat (limited to 'nixpkgs/nixos/modules/tasks/encrypted-devices.nix')
-rw-r--r-- | nixpkgs/nixos/modules/tasks/encrypted-devices.nix | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/nixpkgs/nixos/modules/tasks/encrypted-devices.nix b/nixpkgs/nixos/modules/tasks/encrypted-devices.nix index bc0933f16fe..9c3f2d8fccb 100644 --- a/nixpkgs/nixos/modules/tasks/encrypted-devices.nix +++ b/nixpkgs/nixos/modules/tasks/encrypted-devices.nix @@ -37,7 +37,14 @@ let default = null; example = "/mnt-root/root/.swapkey"; type = types.nullOr types.str; - description = "File system location of keyfile. This unlocks the drive after the root has been mounted to <literal>/mnt-root</literal>."; + description = '' + Path to a keyfile used to unlock the backing encrypted + device. At the time this keyfile is accessed, the + <literal>neededForBoot</literal> filesystems (see + <literal>fileSystems.<name?>.neededForBoot</literal>) + will have been mounted under <literal>/mnt-root</literal>, + so the keyfile path should usually start with "/mnt-root/". + ''; }; }; }; @@ -65,12 +72,16 @@ in boot.initrd = { luks = { devices = - builtins.listToAttrs (map (dev: { name = dev.encrypted.label; value = { device = dev.encrypted.blkDev; }; }) keylessEncDevs); + builtins.listToAttrs (map (dev: { + name = dev.encrypted.label; + value = { device = dev.encrypted.blkDev; }; + }) keylessEncDevs); forceLuksSupportInInitrd = true; }; postMountCommands = - concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n") keyedEncDevs; + concatMapStrings (dev: + "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n" + ) keyedEncDevs; }; }; } - |