···

       
19
       
19
       
 
       
      # drop this service, we'd mount the /run tmpfs over the secret, making it

     

       
20
       
20
       
 
       
      # invisible in stage 2.

     

       
21
       
21
       
 
       
      script = ''

     

       
22
       
22
       
-
       
        for secret in $(cd /.initrd-secrets; find . -type f); do

     

       
22
       
22
       
+
       
        for secret in $(cd /.initrd-secrets; find . -type f -o -type l); do

     

       
23
       
23
       
 
       
          mkdir -p "$(dirname "/$secret")"

     

       
24
       
24
       
 
       
          cp "/.initrd-secrets/$secret" "/$secret"

     

       
25
       
25
       
 
       
        done

     

       
26
       
26
       
 
       
      '';

     

       
27
       
27
       
 
       


     

       
28
       
28
       
-
       
      unitConfig = {

     

       
28
       
28
       
+
       
      serviceConfig = {

     

       
29
       
29
       
 
       
        Type = "oneshot";

     

       
30
       
30
       
 
       
        RemainAfterExit = true;

     

       
31
       
31
       
 
       
      };

     

···

       
880
       
880
       
 
       


     

       
881
       
881
       
 
       
    boot.initrd.kernelModules = optionals (cfg.useNixStoreImage && !cfg.writableStore) [ "erofs" ];

     

       
882
       
882
       
 
       


     

       
883
       
883
       
+
       
    boot.loader.supportsInitrdSecrets = mkIf (!cfg.useBootLoader) (mkVMOverride false);

     

       
884
       
884
       
+
       


     

       
883
       
885
       
 
       
    boot.initrd.extraUtilsCommands = lib.mkIf (cfg.useDefaultFilesystems && !config.boot.initrd.systemd.enable)

     

       
884
       
886
       
 
       
      ''

     

       
885
       
887
       
 
       
        # We need mke2fs in the initrd.

     

···

       
26
       
26
       
 
       
            enable = true;

     

       
27
       
27
       
 
       
            openvpn = {

     

       
28
       
28
       
 
       
              enable = true;

     

       
29
       
29
       
-
       
              configuration = "/dev/null";

     

       
29
       
29
       
+
       
              configuration = builtins.toFile "initrd.ovpn" "";

     

       
30
       
30
       
 
       
            };

     

       
31
       
31
       
 
       
          };

     

       
32
       
32
       
 
       
        };

     

···

       
22
       
22
       
 
       
            hostKeys = [ ./ssh_host_ed25519_key ];

     

       
23
       
23
       
 
       
          };

     

       
24
       
24
       
 
       
        };

     

       
25
       
25
       
-
       
        boot.initrd.extraUtilsCommands = ''

     

       
26
       
26
       
-
       
          mkdir -p $out/secrets/etc/ssh

     

       
27
       
27
       
-
       
          cat "${./ssh_host_ed25519_key}" > $out/secrets/etc/ssh/sh_host_ed25519_key

     

       
28
       
28
       
-
       
        '';

     

       
29
       
25
       
 
       
        boot.initrd.preLVMCommands = ''

     

       
30
       
26
       
 
       
          while true; do

     

       
31
       
27
       
 
       
            if [ -f fnord ]; then