# luks-encrypted data drives, unlocked after boot via /etc/crypttab with
# keyfiles from /etc/nixos/keys/<name>.key on the encrypted root.
# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd
# on the unencrypted /boot.

{ config, lib, ... }:

let
  drives = config.local.dataDrives;
in
{
  options.local.dataDrives = lib.mkOption {
    type = lib.types.attrsOf lib.types.str;
    default = { };
    example = {
      data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
    };
    description = "luks name -> luks partition uuid, mounted at /mnt/<name>";
  };

  config = lib.mkIf (drives != { }) {
    environment.etc.crypttab.text = lib.concatStrings (
      lib.mapAttrsToList (
        name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n"
      ) drives
    );

    fileSystems = lib.mapAttrs' (
      name: _:
      lib.nameValuePair "/mnt/${name}" {
        device = "/dev/mapper/${name}";
        fsType = "ext4";
        options = [ "nofail" ];
      }
    ) drives;
  };
}