Encrypted root support via LUKS

svn path=/nixos/trunk/; revision=24459
This commit is contained in:
Evgeny Egorochkin 2010-10-25 00:57:30 +00:00
parent 88fb000fc1
commit 791c758b41
2 changed files with 46 additions and 0 deletions

View file

@ -146,6 +146,7 @@
./system/activation/activation-script.nix
./system/activation/top-level.nix
./system/boot/kernel.nix
./system/boot/luksroot.nix
./system/boot/modprobe.nix
./system/boot/stage-1.nix
./system/boot/stage-2.nix

View file

@ -0,0 +1,45 @@
{pkgs, config, ...}:
with pkgs.lib;
let
luksRoot = config.boot.initrd.luksRoot;
in
{
options = {
boot.initrd.luksRoot = mkOption {
default = null;
example = "/dev/sda3";
description = '';
The device that should be decrypted using LUKS before trying to mount the
root partition. This works for both LVM-over-LUKS and LUKS-over-LVM setups.
Make sure that initrd has the crypto modules needed for decryption.
The decrypted device name is /dev/mapper/luksroot.
'';
};
};
config = mkIf (luksRoot != null) {
boot.initrd.extraUtilsCommands = ''
cp -r ${pkgs.cryptsetup}/lib/* $out/lib/
cp -r ${pkgs.popt}/lib/* $out/lib
cp ${pkgs.cryptsetup}/sbin/* $out/bin
'';
boot.initrd.postDeviceCommands = ''
cryptsetup luksOpen ${luksRoot} luksroot
lvm vgscan
lvm vgchange -ay
'';
};
}