pyrox.dev
1import ./make-test-python.nix ({ lib, pkgs, ... }: {
2 name = "systemd-initrd-luks-password";
3
4 nodes.machine = { pkgs, ... }: {
5 # Use systemd-boot
6 virtualisation = {
7 emptyDiskImages = [ 512 512 ];
8 useBootLoader = true;
9 useEFIBoot = true;
10 };
11 boot.loader.systemd-boot.enable = true;
12
13 environment.systemPackages = with pkgs; [ cryptsetup ];
14 boot.initrd.systemd = {
15 enable = true;
16 emergencyAccess = true;
17 };
18
19 specialisation.boot-luks.configuration = {
20 boot.initrd.luks.devices = lib.mkVMOverride {
21 # We have two disks and only type one password - key reuse is in place
22 cryptroot.device = "/dev/vdb";
23 cryptroot2.device = "/dev/vdc";
24 };
25 virtualisation.rootDevice = "/dev/mapper/cryptroot";
26 # test mounting device unlocked in initrd after switching root
27 virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
28 };
29 };
30
31 testScript = ''
32 # Create encrypted volume
33 machine.wait_for_unit("multi-user.target")
34 machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
35 machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
36 machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2")
37 machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
38
39 # Boot from the encrypted disk
40 machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
41 machine.succeed("sync")
42 machine.crash()
43
44 # Boot and decrypt the disk
45 machine.start()
46 machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
47 machine.send_console("supersecret\n")
48 machine.wait_for_unit("multi-user.target")
49
50 assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
51 assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
52 '';
53})