mirror of
https://github.com/ilyakooo0/nixpkgs.git
synced 2024-09-11 07:15:54 +03:00
nixos/bcachefs: support unlock with clevis in systemd stage 1
This commit is contained in:
parent
04c145b57d
commit
10035ed5ab
@ -57,7 +57,9 @@ let
|
||||
# bcachefs does not support mounting devices with colons in the path, ergo we don't (see #49671)
|
||||
firstDevice = fs: lib.head (lib.splitString ":" fs.device);
|
||||
|
||||
openCommand = name: fs: if config.boot.initrd.clevis.enable && (lib.hasAttr (firstDevice fs) config.boot.initrd.clevis.devices) then ''
|
||||
useClevis = fs: config.boot.initrd.clevis.enable && (lib.hasAttr (firstDevice fs) config.boot.initrd.clevis.devices);
|
||||
|
||||
openCommand = name: fs: if useClevis fs then ''
|
||||
if clevis decrypt < /etc/clevis/${firstDevice fs}.jwe | bcachefs unlock ${firstDevice fs}
|
||||
then
|
||||
printf "unlocked ${name} using clevis\n"
|
||||
@ -92,8 +94,19 @@ let
|
||||
# As is, RemainAfterExit doesn't accomplish anything.
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
${config.boot.initrd.systemd.package}/bin/systemd-ask-password --timeout=0 "enter passphrase for ${name}" | exec ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${device}"
|
||||
script = let
|
||||
unlock = ''${pkgs.bcachefs-tools}/bin/bcachefs unlock "${device}"'';
|
||||
unlockInteractively = ''${config.boot.initrd.systemd.package}/bin/systemd-ask-password --timeout=0 "enter passphrase for ${name}" | exec ${unlock}'';
|
||||
in if useClevis fs then ''
|
||||
if ${config.boot.initrd.clevis.package}/bin/clevis decrypt < "/etc/clevis/${device}.jwe" | ${unlock}
|
||||
then
|
||||
printf "unlocked ${name} using clevis\n"
|
||||
else
|
||||
printf "falling back to interactive unlocking...\n"
|
||||
${unlockInteractively}
|
||||
fi
|
||||
'' else ''
|
||||
${unlockInteractively}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
Loading…
Reference in New Issue
Block a user