pyrox.dev
1import ./make-test-python.nix ({ lib, pkgs, ... }: {
2 name = "systemd-initrd-luks-password";
3
4 nodes.machine = { pkgs, ... }: {
5 # Use systemd-boot
6 virtualisation = {
7 emptyDiskImages = [ 512 512 ];
8 useBootLoader = true;
9 # Booting off the encrypted disk requires an available init script
10 mountHostNixStore = true;
11 useEFIBoot = true;
12 };
13 boot.loader.systemd-boot.enable = true;
14
15 environment.systemPackages = with pkgs; [ cryptsetup ];
16 boot.initrd.systemd = {
17 enable = true;
18 emergencyAccess = true;
19 };
20
21 specialisation.boot-luks.configuration = {
22 boot.initrd.luks.devices = lib.mkVMOverride {
23 # We have two disks and only type one password - key reuse is in place
24 cryptroot.device = "/dev/vdb";
25 cryptroot2.device = "/dev/vdc";
26 };
27 virtualisation.rootDevice = "/dev/mapper/cryptroot";
28 virtualisation.fileSystems."/".autoFormat = true;
29 # test mounting device unlocked in initrd after switching root
30 virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
31 };
32 };
33
34 testScript = ''
35 # Create encrypted volume
36 machine.wait_for_unit("multi-user.target")
37 machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
38 machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
39 machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2")
40 machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
41
42 # Boot from the encrypted disk
43 machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
44 machine.succeed("sync")
45 machine.crash()
46
47 # Boot and decrypt the disk
48 machine.start()
49 machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
50 machine.send_console("supersecret\n")
51 machine.wait_for_unit("multi-user.target")
52
53 assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
54 assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
55 '';
56})