diff options
| author | Matt Moriarity <matt@mattmoriarity.com> | 2024-03-13 17:20:10 -0600 |
|---|---|---|
| committer | Julien Malka <julien@malka.sh> | 2024-04-05 14:39:11 +0000 |
| commit | 10035ed5ab17609d8c4c4c52dfaf852f1c9cd28c (patch) | |
| tree | 923fd4b94941bdc3590650157ebc27323d532c93 /nixos/modules/tasks/filesystems | |
| parent | 04c145b57d51e976809bbb3d2b630a3e98b39df9 (diff) | |
nixos/bcachefs: support unlock with clevis in systemd stage 1
Diffstat (limited to 'nixos/modules/tasks/filesystems')
| -rw-r--r-- | nixos/modules/tasks/filesystems/bcachefs.nix | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix index ba33edd702f70..d7e83464391c4 100644 --- a/nixos/modules/tasks/filesystems/bcachefs.nix +++ b/nixos/modules/tasks/filesystems/bcachefs.nix @@ -57,7 +57,9 @@ let # bcachefs does not support mounting devices with colons in the path, ergo we don't (see #49671) firstDevice = fs: lib.head (lib.splitString ":" fs.device); - openCommand = name: fs: if config.boot.initrd.clevis.enable && (lib.hasAttr (firstDevice fs) config.boot.initrd.clevis.devices) then '' + useClevis = fs: config.boot.initrd.clevis.enable && (lib.hasAttr (firstDevice fs) config.boot.initrd.clevis.devices); + + openCommand = name: fs: if useClevis fs then '' if clevis decrypt < /etc/clevis/${firstDevice fs}.jwe | bcachefs unlock ${firstDevice fs} then printf "unlocked ${name} using clevis\n" @@ -92,8 +94,19 @@ let # As is, RemainAfterExit doesn't accomplish anything. RemainAfterExit = true; }; - script = '' - ${config.boot.initrd.systemd.package}/bin/systemd-ask-password --timeout=0 "enter passphrase for ${name}" | exec ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${device}" + script = let + unlock = ''${pkgs.bcachefs-tools}/bin/bcachefs unlock "${device}"''; + unlockInteractively = ''${config.boot.initrd.systemd.package}/bin/systemd-ask-password --timeout=0 "enter passphrase for ${name}" | exec ${unlock}''; + in if useClevis fs then '' + if ${config.boot.initrd.clevis.package}/bin/clevis decrypt < "/etc/clevis/${device}.jwe" | ${unlock} + then + printf "unlocked ${name} using clevis\n" + else + printf "falling back to interactive unlocking...\n" + ${unlockInteractively} + fi + '' else '' + ${unlockInteractively} ''; }; }; |