aaron
450559f8c6
- increase security by restricting /boot to root only - add data-drives for encrypted drives that will get mounted through crypttab rather than the initrd Reviewed-on: #87 Co-authored-by: aaron <aaron@0x29a.ch>
38 lines
1.0 KiB
Nix
38 lines
1.0 KiB
Nix
# luks-encrypted data drives, unlocked after boot via /etc/crypttab with
|
|
# keyfiles from /etc/nixos/keys/<name>.key on the encrypted root.
|
|
# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd
|
|
# on the unencrypted /boot.
|
|
|
|
{ config, lib, ... }:
|
|
|
|
let
|
|
drives = config.local.dataDrives;
|
|
in
|
|
{
|
|
options.local.dataDrives = lib.mkOption {
|
|
type = lib.types.attrsOf lib.types.str;
|
|
default = { };
|
|
example = {
|
|
data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
|
|
};
|
|
description = "luks name -> luks partition uuid, mounted at /mnt/<name>";
|
|
};
|
|
|
|
config = lib.mkIf (drives != { }) {
|
|
environment.etc.crypttab.text = lib.concatStrings (
|
|
lib.mapAttrsToList (
|
|
name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n"
|
|
) drives
|
|
);
|
|
|
|
fileSystems = lib.mapAttrs' (
|
|
name: _:
|
|
lib.nameValuePair "/mnt/${name}" {
|
|
device = "/dev/mapper/${name}";
|
|
fsType = "ext4";
|
|
options = [ "nofail" ];
|
|
}
|
|
) drives;
|
|
};
|
|
}
|