54 lines
1.2 KiB
Nix
54 lines
1.2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
with lib; let
|
|
baseCfg = config.gen.bootloader;
|
|
cfg = baseCfg.luksSsh;
|
|
in {
|
|
options.gen.bootloader.luksSsh = {
|
|
enable = mkEnableOption "use boot process with luks unlock over ssh";
|
|
port = mkOption {
|
|
type = types.port;
|
|
description = "port for ssh server to listen on";
|
|
};
|
|
hostKeys = mkOption {
|
|
type = types.listOf types.path;
|
|
description = "paths of host keys for the ssh server to use";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
# ### Use systemd-boot ###
|
|
# boot.loader = {
|
|
# efi.canTouchEfiVariables = true;
|
|
|
|
# timeout = 2;
|
|
# systemd-boot = {
|
|
# enable = true;
|
|
# configurationLimit = 3;
|
|
# };
|
|
# };
|
|
|
|
### LUKS unlock through SSH ###
|
|
boot.initrd = {
|
|
network = {
|
|
enable = true;
|
|
flushBeforeStage2 = true;
|
|
|
|
ssh = {
|
|
enable = true;
|
|
authorizedKeys = import ../../keys/ssh.nix;
|
|
inherit (cfg) hostKeys port;
|
|
};
|
|
|
|
postCommands = ''
|
|
# Automatically ask for the password on SSH login
|
|
echo 'cryptsetup-askpass || echo "Unlock was successful; exiting SSH session" && exit 1' >> /root/.profile
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|