diff options
author | Michele Guerini Rocco <rnhmjoj@users.noreply.github.com> | 2023-01-17 00:48:58 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-01-17 00:48:58 +0100 |
commit | 594b94b4c3038f5c2cfb2f5d9c10ef30c7070a4c (patch) | |
tree | 77fd1ee86169a0f9f7544012e5d8c012370f5fec /nixos/tests | |
parent | ea27fb07efe68cb426593a4d7c2efe469621021d (diff) | |
parent | 9bb888c9f8224e45fc54d9f345369786cbd78bb6 (diff) |
Merge pull request #210812 from rnhmjoj/pr-initrd-secrets
boot.initrd.secrets fixes
Diffstat (limited to 'nixos/tests')
-rw-r--r-- | nixos/tests/installer.nix | 54 |
1 files changed, 51 insertions, 3 deletions
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index 0884b0436f8b1..f5455267b2863 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -51,7 +51,7 @@ let boot.loader.systemd-boot.enable = true; ''} - boot.initrd.secrets."/etc/secret" = /etc/nixos/secret; + boot.initrd.secrets."/etc/secret" = ./secret; users.users.alice = { isNormalUser = true; @@ -150,8 +150,7 @@ let ) with subtest("Shutdown system after installation"): - machine.succeed("umount /mnt/boot || true") - machine.succeed("umount /mnt") + machine.succeed("umount -R /mnt") machine.succeed("sync") machine.shutdown() @@ -672,6 +671,55 @@ in { ''; }; + # Full disk encryption (root, kernel and initrd encrypted) using GRUB, GPT/UEFI, + # LVM-on-LUKS and a keyfile in initrd.secrets to enter the passphrase once + fullDiskEncryption = makeInstallerTest "fullDiskEncryption" { + createPartitions = '' + machine.succeed( + "flock /dev/vda parted --script /dev/vda -- mklabel gpt" + + " mkpart ESP fat32 1M 100MiB" # /boot/efi + + " set 1 boot on" + + " mkpart primary ext2 1024MiB -1MiB", # LUKS + "udevadm settle", + "modprobe dm_mod dm_crypt", + "dd if=/dev/random of=luks.key bs=256 count=1", + "echo -n supersecret | cryptsetup luksFormat -q --pbkdf-force-iterations 1000 --type luks1 /dev/vda2 -", + "echo -n supersecret | cryptsetup luksAddKey -q --pbkdf-force-iterations 1000 --key-file - /dev/vda2 luks.key", + "echo -n supersecret | cryptsetup luksOpen --key-file - /dev/vda2 crypt", + "pvcreate /dev/mapper/crypt", + "vgcreate crypt /dev/mapper/crypt", + "lvcreate -L 100M -n swap crypt", + "lvcreate -l '100%FREE' -n nixos crypt", + "mkfs.vfat -n efi /dev/vda1", + "mkfs.ext4 -L nixos /dev/crypt/nixos", + "mkswap -L swap /dev/crypt/swap", + "mount LABEL=nixos /mnt", + "mkdir -p /mnt/{etc/nixos,boot/efi}", + "mount LABEL=efi /mnt/boot/efi", + "swapon -L swap", + "mv luks.key /mnt/etc/nixos/" + ) + ''; + bootLoader = "grub"; + grubUseEfi = true; + extraConfig = '' + boot.loader.grub.enableCryptodisk = true; + boot.loader.efi.efiSysMountPoint = "/boot/efi"; + + boot.initrd.secrets."/luks.key" = ./luks.key; + boot.initrd.luks.devices.crypt = + { device = "/dev/vda2"; + keyFile = "/luks.key"; + }; + ''; + enableOCR = true; + preBootCommands = '' + machine.start() + machine.wait_for_text("Enter passphrase for") + machine.send_chars("supersecret\n") + ''; + }; + swraid = makeInstallerTest "swraid" { createPartitions = '' machine.succeed( |