diff options
author | Ryan Lahfa <masterancpp@gmail.com> | 2023-10-29 22:24:38 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-10-29 22:24:38 +0100 |
commit | a905c3a544a422b92db99758489e20d84ed755cb (patch) | |
tree | 3d5474085b0245208e1ee776d82a4364e2edca14 /nixos/modules/tasks | |
parent | 707696ccd6a493c062dd14b60cea1d1ab208fac0 (diff) | |
parent | 0425c4de6d1ebade3c082698a9d47b2f1b0080db (diff) | |
download | nixlib-a905c3a544a422b92db99758489e20d84ed755cb.tar nixlib-a905c3a544a422b92db99758489e20d84ed755cb.tar.gz nixlib-a905c3a544a422b92db99758489e20d84ed755cb.tar.bz2 nixlib-a905c3a544a422b92db99758489e20d84ed755cb.tar.lz nixlib-a905c3a544a422b92db99758489e20d84ed755cb.tar.xz nixlib-a905c3a544a422b92db99758489e20d84ed755cb.tar.zst nixlib-a905c3a544a422b92db99758489e20d84ed755cb.zip |
Merge pull request #262854 from ElvishJerricco/systemd-stage-1-bcachefs-decryption
systemd-stage-1: bcachefs decryption
Diffstat (limited to 'nixos/modules/tasks')
-rw-r--r-- | nixos/modules/tasks/filesystems/bcachefs.nix | 50 |
1 files changed, 40 insertions, 10 deletions
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix index 19ef188ce783..b90ff894624e 100644 --- a/nixos/modules/tasks/filesystems/bcachefs.nix +++ b/nixos/modules/tasks/filesystems/bcachefs.nix @@ -34,17 +34,43 @@ let } ''; - openCommand = name: fs: - let - # we need only unlock one device manually, and cannot pass multiple at once - # remove this adaptation when bcachefs implements mounting by filesystem uuid - # also, implement automatic waiting for the constituent devices when that happens - # bcachefs does not support mounting devices with colons in the path, ergo we don't (see #49671) - firstDevice = head (splitString ":" fs.device); - in - '' - tryUnlock ${name} ${firstDevice} + # we need only unlock one device manually, and cannot pass multiple at once + # remove this adaptation when bcachefs implements mounting by filesystem uuid + # also, implement automatic waiting for the constituent devices when that happens + # bcachefs does not support mounting devices with colons in the path, ergo we don't (see #49671) + firstDevice = fs: head (splitString ":" fs.device); + + openCommand = name: fs: '' + tryUnlock ${name} ${firstDevice fs} + ''; + + mkUnits = prefix: name: fs: let + mountUnit = "${utils.escapeSystemdPath (prefix + (lib.removeSuffix "/" fs.mountPoint))}.mount"; + device = firstDevice fs; + deviceUnit = "${utils.escapeSystemdPath device}.device"; + in { + name = "unlock-bcachefs-${utils.escapeSystemdPath fs.mountPoint}"; + value = { + description = "Unlock bcachefs for ${fs.mountPoint}"; + requiredBy = [ mountUnit ]; + before = [ mountUnit ]; + bindsTo = [ deviceUnit ]; + after = [ deviceUnit ]; + unitConfig.DefaultDependencies = false; + serviceConfig = { + Type = "oneshot"; + ExecCondition = "${pkgs.bcachefs-tools}/bin/bcachefs unlock -c \"${device}\""; + Restart = "on-failure"; + RestartMode = "direct"; + # Ideally, this service would lock the key on stop. + # As is, RemainAfterExit doesn't accomplish anything. + RemainAfterExit = true; + }; + script = '' + ${config.boot.initrd.systemd.package}/bin/systemd-ask-password --timeout=0 "enter passphrase for ${name}" | exec ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${device}" ''; + }; + }; in @@ -59,6 +85,8 @@ in # use kernel package with bcachefs support until it's in mainline boot.kernelPackages = pkgs.linuxPackages_testing_bcachefs; + + systemd.services = lib.mapAttrs' (mkUnits "") (lib.filterAttrs (n: fs: (fs.fsType == "bcachefs") && (!utils.fsNeededForBoot fs)) config.fileSystems); } (mkIf ((elem "bcachefs" config.boot.initrd.supportedFilesystems) || (bootFs != {})) { @@ -79,6 +107,8 @@ in ''; boot.initrd.postDeviceCommands = commonFunctions + concatStrings (mapAttrsToList openCommand bootFs); + + boot.initrd.systemd.services = lib.mapAttrs' (mkUnits "/sysroot") bootFs; }) ]); } |