commit c3d5cfdc3ca709a9c5081b1a11bca533bc4788af · pyrox.dev/nixpkgs

+31 -11

nixos/modules/config/swap.nix

···

       45
       45
        
               '';

     

       46
       46
        
             };

     

       47
       47
        
       

     

       48
       48
       -
             randomEncryption = mkOption {

     

       48
       48
       +
             randomEncryption.enable = mkOption {

     

       49
       49
        
               default = false;

     

       50
       50
        
               type = types.bool;

     

       51
       51
        
               description = ''

     
···

       61
       61
        
               '';

     

       62
       62
        
             };

     

       63
       63
        
       

     

       64
       64
       +
             randomEncryption.cipher = mkOption {

     

       65
       65
       +
               default = "aes-xts-plain64";

     

       66
       66
       +
               example = "serpent-xts-plain64";

     

       67
       67
       +
               type = types.str;

     

       68
       68
       +
               description = ''

     

       69
       69
       +
                 Use specified cipher for randomEncryption.

     

       70
       70
       +
       

     

       71
       71
       +
                 Hint: Run "cryptsetup benchmark" to see which one is fastest on your machine.

     

       72
       72
       +
               '';

     

       73
       73
       +
             };

     

       74
       74
       +
       

     

       75
       75
       +
             randomEncryption.source = mkOption {

     

       76
       76
       +
               default = "/dev/urandom";

     

       77
       77
       +
               example = "/dev/random";

     

       78
       78
       +
               type = types.str;

     

       79
       79
       +
               description = ''

     

       80
       80
       +
                 Define the source of randomness to obtain a random key for encryption.

     

       81
       81
       +
               '';

     

       82
       82
       +
             };

     

       83
       83
       +
       

     

       64
       84
        
             deviceName = mkOption {

     

       65
       85
        
               type = types.str;

     

       66
       86
        
               internal = true;

     
···

       77
       97
        
             device = mkIf options.label.isDefined

     

       78
       98
        
               "/dev/disk/by-label/${config.label}";

     

       79
       99
        
             deviceName = lib.replaceChars ["\\"] [""] (escapeSystemdPath config.device);

     

       80
       80
       -
             realDevice = if config.randomEncryption then "/dev/mapper/${deviceName}" else config.device;

     

       100
       100
       +
             realDevice = if config.randomEncryption.enable then "/dev/mapper/${deviceName}" else config.device;

     

       81
       101
        
           };

     

       82
       102
        
       

     

       83
       103
        
         };

     
···

       125
       145
        
       

     

       126
       146
        
               createSwapDevice = sw:

     

       127
       147
        
                 assert sw.device != "";

     

       128
       128
       -
                 assert !(sw.randomEncryption && lib.hasPrefix "/dev/disk/by-uuid"  sw.device);

     

       129
       129
       -
                 assert !(sw.randomEncryption && lib.hasPrefix "/dev/disk/by-label" sw.device);

     

       148
       148
       +
                 assert !(sw.randomEncryption.enable && lib.hasPrefix "/dev/disk/by-uuid"  sw.device);

     

       149
       149
       +
                 assert !(sw.randomEncryption.enable && lib.hasPrefix "/dev/disk/by-label" sw.device);

     

       130
       150
        
                 let realDevice' = escapeSystemdPath sw.realDevice;

     

       131
       151
        
                 in nameValuePair "mkswap-${sw.deviceName}"

     

       132
       152
        
                 { description = "Initialisation of swap device ${sw.device}";

     

       133
       153
        
                   wantedBy = [ "${realDevice'}.swap" ];

     

       134
       154
        
                   before = [ "${realDevice'}.swap" ];

     

       135
       135
       -
                   path = [ pkgs.utillinux ] ++ optional sw.randomEncryption pkgs.cryptsetup;

     

       155
       155
       +
                   path = [ pkgs.utillinux ] ++ optional sw.randomEncryption.enable pkgs.cryptsetup;

     

       136
       156
        
       

     

       137
       157
        
                   script =

     

       138
       158
        
                     ''

     
···

       145
       165
        
                             truncate --size "${toString sw.size}M" "${sw.device}"

     

       146
       166
        
                           fi

     

       147
       167
        
                           chmod 0600 ${sw.device}

     

       148
       148
       -
                           ${optionalString (!sw.randomEncryption) "mkswap ${sw.realDevice}"}

     

       168
       168
       +
                           ${optionalString (!sw.randomEncryption.enable) "mkswap ${sw.realDevice}"}

     

       149
       169
        
                         fi

     

       150
       170
        
                       ''}

     

       151
       151
       -
                       ${optionalString sw.randomEncryption ''

     

       152
       152
       -
                         cryptsetup open ${sw.device} ${sw.deviceName} --type plain --key-file /dev/urandom

     

       171
       171
       +
                       ${optionalString sw.randomEncryption.enable ''

     

       172
       172
       +
                         cryptsetup plainOpen -c ${sw.randomEncryption.cipher} -d ${sw.randomEncryption.source} ${sw.device} ${sw.deviceName}

     

       153
       173
        
                         mkswap ${sw.realDevice}

     

       154
       174
        
                       ''}

     

       155
       175
        
                     '';

     
···

       157
       177
        
                   unitConfig.RequiresMountsFor = [ "${dirOf sw.device}" ];

     

       158
       178
        
                   unitConfig.DefaultDependencies = false; # needed to prevent a cycle

     

       159
       179
        
                   serviceConfig.Type = "oneshot";

     

       160
       160
       -
                   serviceConfig.RemainAfterExit = sw.randomEncryption;

     

       161
       161
       -
                   serviceConfig.ExecStop = optionalString sw.randomEncryption "${pkgs.cryptsetup}/bin/cryptsetup luksClose ${sw.deviceName}";

     

       180
       180
       +
                   serviceConfig.RemainAfterExit = sw.randomEncryption.enable;

     

       181
       181
       +
                   serviceConfig.ExecStop = optionalString sw.randomEncryption.enable "${pkgs.cryptsetup}/bin/cryptsetup luksClose ${sw.deviceName}";

     

       162
       182
        
                   restartIfChanged = false;

     

       163
       183
        
                 };

     

       164
       184
        
       

     

       165
       165
       -
             in listToAttrs (map createSwapDevice (filter (sw: sw.size != null || sw.randomEncryption) config.swapDevices));

     

       185
       185
       +
             in listToAttrs (map createSwapDevice (filter (sw: sw.size != null || sw.randomEncryption.enable) config.swapDevices));

     

       166
       186
        
       

     

       167
       187
        
         };

     

       168
       188

+1 -1

nixos/modules/system/boot/stage-1.nix

···

       207
       207
        
             preLVMCommands preDeviceCommands postDeviceCommands postMountCommands preFailCommands kernelModules;

     

       208
       208
        
       

     

       209
       209
        
           resumeDevices = map (sd: if sd ? device then sd.device else "/dev/disk/by-label/${sd.label}")

     

       210
       210
       -
                           (filter (sd: hasPrefix "/dev/" sd.device && !sd.randomEncryption

     

       210
       210
       +
                           (filter (sd: hasPrefix "/dev/" sd.device && !sd.randomEncryption.enable

     

       211
       211
        
                                    # Don't include zram devices

     

       212
       212
        
                                    && !(hasPrefix "/dev/zram" sd.device)

     

       213
       213
        
                                   ) config.swapDevices);