···

       
6
       
6
       
 
       
  fileSystems = attrValues config.fileSystems ++ config.swapDevices;

     

       
7
       
7
       
 
       
  encDevs = filter (dev: dev.encrypted.enable) fileSystems;

     

       
8
       
8
       
 
       
  keyedEncDevs = filter (dev: dev.encrypted.keyFile != null) encDevs;

     

       
9
       
9
       
+
       
  keylessEncDevs = filter (dev: dev.encrypted.keyFile == null) encDevs;

     

       
9
       
10
       
 
       
  isIn = needle: haystack: filter (p: p == needle) haystack != [];

     

       
10
       
11
       
 
       
  anyEncrypted =

     

       
11
       
12
       
 
       
    fold (j: v: v || j.encrypted.enable) false encDevs;

     
···

       
29
       
30
       
 
       
      label = mkOption {

     

       
30
       
31
       
 
       
        default = null;

     

       
31
       
32
       
 
       
        example = "rootfs";

     

       
32
       
32
       
-
       
        type = types.nullOr types.str;

     

       
33
       
33
       
-
       
        description = "Label of the backing encrypted device.";

     

       
33
       
33
       
+
       
        type = types.uniq (types.nullOr types.str);

     

       
34
       
34
       
+
       
        description = "Label of the unlocked encrypted device. Set <literal>fileSystems.&lt;name?&gt;.device</literal> to <literal>/dev/mapper/&lt;label&gt;</literal> to mount the unlocked device.";

     

       
34
       
35
       
 
       
      };

     

       
35
       
36
       
 
       


     

       
36
       
37
       
 
       
      keyFile = mkOption {

     

       
37
       
38
       
 
       
        default = null;

     

       
38
       
39
       
 
       
        example = "/root/.swapkey";

     

       
39
       
40
       
 
       
        type = types.nullOr types.str;

     

       
40
       
40
       
-
       
        description = "File system location of keyfile.";

     

       
41
       
41
       
+
       
        description = "File system location of keyfile. This unlocks the drive after the root has been mounted to <literal>/mnt-root</literal>.";

     

       
41
       
42
       
 
       
      };

     

       
42
       
43
       
 
       
    };

     

       
43
       
44
       
 
       
  };

     
···

       
58
       
59
       
 
       
    boot.initrd = {

     

       
59
       
60
       
 
       
      luks = {

     

       
60
       
61
       
 
       
        devices =

     

       
61
       
61
       
-
       
          map (dev: { name = dev.encrypted.label; device = dev.encrypted.blkDev; } ) encDevs;

     

       
62
       
62
       
+
       
          map (dev: { name = dev.encrypted.label; device = dev.encrypted.blkDev; } ) keylessEncDevs;

     

       
62
       
63
       
 
       
        cryptoModules = [ "aes" "sha256" "sha1" "xts" ];

     

       
63
       
64
       
 
       
      };

     

       
64
       
65
       
 
       
      postMountCommands =

     

       
65
       
65
       
-
       
        concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.label};\n") keyedEncDevs;

     

       
66
       
66
       
+
       
        concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n") keyedEncDevs;

     

       
66
       
67
       
 
       
    };

     

       
67
       
68
       
 
       
  };

     

       
68
       
69
       
 
       
}