Mirrors/disko
2
0
Fork 0
mirror of https://github.com/nix-community/disko synced 2024-09-20 05:51:54 +00:00
Code Issues Projects Releases Packages Wiki Activity

add additionalKeyFiles option to luks

Browse source
This commit is contained in:
arch 2023-07-06 20:33:44 +02:00 committed by mergify[bot]
parent 68eb09b183
commit 7eb0940839
4 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
example/complex.nix
View file

@ -32,6 +32,7 @@
type = "luks";
name = "crypted1";
settings.keyFile = "/tmp/secret.key";
additionalKeyFiles = ["/tmp/additionalSecret.key"];
extraFormatArgs = [
"--iter-time 1" # unsecure but fast for tests
];

1
example/luks-lvm.nix
View file

@ -33,6 +33,7 @@
# if you want to use the key for interactive login be sure there is no trailing newline
# for example use `echo -n "password" > /tmp/secret.key`
settings.keyFile = "/tmp/secret.key";
additionalKeyFiles = ["/tmp/additionalSecret.key"];
content = {
type = "lvm_pv";
vg = "pool";

7
lib/types/luks.nix
View file

@ -44,6 +44,12 @@ in
};
'';
};
additionalKeyFiles = lib.mkOption {
type = lib.types.listOf diskoLib.optionTypes.absolute-pathname;
default = [];
description = "Path to additional key files for encryption";
example = ["/tmp/disk2.key"];
};
initrdUnlock = lib.mkOption {
type = lib.types.bool;
default = true;
@ -82,6 +88,7 @@ in
cryptsetup luksOpen ${config.device} ${config.name} \
${toString config.extraOpenArgs} \
${keyFileArgs}
${toString (lib.lists.forEach config.additionalKeyFiles (x: "cryptsetup luksAddKey ${config.device} ${x} ${keyFileArgs}"))}
${lib.optionalString (config.content != null) config.content._create}
'';
};

1
tests/lib.nix
View file

@ -135,6 +135,7 @@
machine.start()
machine.succeed("echo -n 'secretsecret' > /tmp/secret.key")
machine.succeed("echo -n 'additionalSecret' > /tmp/additionalSecret.key")
${lib.optionalString (testMode == "direct") ''
machine.succeed("${tsp-create}")
machine.succeed("${tsp-mount}")