nixos: unattended boot: migrate to systemdinit

1 files changed, 29 insertions, 22 deletions

diff --git a/modules/nixos/personal/boot.nix b/modules/nixos/personal/boot.nix
index bde1ab0..68d4d66 100644
--- a/modules/nixos/personal/boot.nix
+++ b/modules/nixos/personal/boot.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 let
@@ -13,35 +14,41 @@ in
     unattendedReboot = lib.mkEnableOption "unattended reboots";
   };
 
-  config.boot = {
-    loader = lib.mkMerge [
-      (lib.mkIf cfg.grub.enable {
-        grub = {
-          enable = true;
-          enableCryptodisk = config.boot.initrd.luks.devices != { };
-          device = lib.mkDefault "nodev";
-        };
-      })
-      (lib.mkIf cfg.efi.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.grub.enable {
+      boot.loader.grub = {
+        enable = true;
+        enableCryptodisk = config.boot.initrd.luks.devices != { };
+        device = lib.mkDefault "nodev";
+      };
+    })
+    (lib.mkIf cfg.efi.enable {
+      boot.loader = {
         efi.canTouchEfiVariables = true;
         grub.efiSupport = true;
-      })
-    ];
-
-    initrd =
+      };
+    })
+    (
       let
         crypt = config.personal.hardware.disks.crypted;
       in
       lib.mkIf (cfg.unattendedReboot && crypt != null) {
-        secrets."/keyfile.luks" = /etc/luks/keys/tmp;
-        luks.devices.crypt = {
-          fallbackToPassword = true;
-          keyFile = "/keyfile.luks";
-          postOpenCommands = ''
+        boot.initrd = {
+          secrets."/keyfile.luks" = /etc/luks/keys/tmp;
+          luks.devices.crypt.keyFile = "/keyfile.luks";
+        };
+        systemd.services.luks-post-open = {
+          description = "Run commands after LUKS unlock";
+          wantedBy = [ "cryptsetup.target" ];
+          after = [ "cryptsetup.target" ];
+          serviceConfig.Type = "oneshot";
+          path = [ pkgs.cryptsetup ];
+          script = ''
             echo "Disabling temporary LUKS key file..."
-            cryptsetup --verbose luksRemoveKey ${crypt} /keyfile.luks
+            cryptsetup --verbose luksRemoveKey ${crypt} /etc/luks/keys/tmp;
           '';
         };
-      };
-  };
+      }
+    )
+  ];
 }