blob: 68d4d66652fec78de527b5f267e642d1dda894ef (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.personal.boot;
in
{
options.personal.boot = {
grub.enable = lib.mkEnableOption "grub";
efi.enable = lib.mkEnableOption "EFI";
unattendedReboot = lib.mkEnableOption "unattended reboots";
};
config = lib.mkMerge [
(lib.mkIf cfg.grub.enable {
boot.loader.grub = {
enable = true;
enableCryptodisk = config.boot.initrd.luks.devices != { };
device = lib.mkDefault "nodev";
};
})
(lib.mkIf cfg.efi.enable {
boot.loader = {
efi.canTouchEfiVariables = true;
grub.efiSupport = true;
};
})
(
let
crypt = config.personal.hardware.disks.crypted;
in
lib.mkIf (cfg.unattendedReboot && crypt != null) {
boot.initrd = {
secrets."/keyfile.luks" = /etc/luks/keys/tmp;
luks.devices.crypt.keyFile = "/keyfile.luks";
};
systemd.services.luks-post-open = {
description = "Run commands after LUKS unlock";
wantedBy = [ "cryptsetup.target" ];
after = [ "cryptsetup.target" ];
serviceConfig.Type = "oneshot";
path = [ pkgs.cryptsetup ];
script = ''
echo "Disabling temporary LUKS key file..."
cryptsetup --verbose luksRemoveKey ${crypt} /etc/luks/keys/tmp;
'';
};
}
)
];
}
|
