diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/usbauth/default.nix | 62 | ||||
| -rw-r--r-- | modules/usbauth/usbauth.sh | 6 |
2 files changed, 39 insertions, 29 deletions
diff --git a/modules/usbauth/default.nix b/modules/usbauth/default.nix index 1784221..7054efa 100644 --- a/modules/usbauth/default.nix +++ b/modules/usbauth/default.nix @@ -1,37 +1,41 @@ { - config, - lib, - modulesPath, - pkgs, - ... + config, + lib, + modulesPath, + pkgs, + ... }: { - imports = [ (modulesPath + "/profiles/all-hardware.nix") ]; + imports = [ (modulesPath + "/profiles/all-hardware.nix") ]; - options.usbauth = lib.mkOption { - description = "USB Auth"; - type = lib.types.submodule { - options = { - enable = lib.mkOption { type = lib.types.bool; }; - device = lib.mkOption { type = lib.types.str; }; - keyname = lib.mkOption { type = lib.types.str; }; - uuid = lib.mkOption { type = lib.types.str; }; - }; - }; - }; + options.usbauth = lib.mkOption { + description = "USB Auth"; + type = lib.types.submodule { + options = { + enable = lib.mkOption { type = lib.types.bool; default = false; }; + device = lib.mkOption { type = lib.types.str; }; + keyname = lib.mkOption { type = lib.types.str; }; + uuid = lib.mkOption { type = lib.types.str; }; + }; + }; + }; - config = lib.mkIf config.usbauth.enable { - boot.initrd.postDeviceCommands = pkgs.lib.mkBefore '' - mkdir -m 0755 -p /key - while ! findfs UUID=${config.usbauth.uuid} 2> /dev/null; do sleep 0.1; done > /dev/null - cryptsetup open $(findfs UUID=${config.usbauth.uuid}) _key - mount -o ro "/dev/mapper/_key" /key - ''; + config = lib.mkIf config.usbauth.enable { + boot.initrd.systemd.services.usb-auth-setup = { + description = "USBAuth Setup"; + before = [ "cryptsetup-pre.target" ]; - boot.initrd.luks.devices."${config.usbauth.device}" = { - keyFile = "/key/.keys/${config.usbauth.keyname}"; - preLVM = false; - }; - }; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.bash}/bin/bash ${./usbauth.sh} ${config.usbauth.uuid}"; + }; + + wantedBy = [ "sysinit.target" ]; + }; + + boot.initrd.luks.devices."${config.usbauth.device}" = { + keyFile = "/key/.keys/${config.usbauth.keyname}"; + }; + }; } diff --git a/modules/usbauth/usbauth.sh b/modules/usbauth/usbauth.sh new file mode 100644 index 0000000..b88954c --- /dev/null +++ b/modules/usbauth/usbauth.sh @@ -0,0 +1,6 @@ +UUID=$1 + +mkdir -m 0755 -p /key +while ! findfs UUID=$UUID 2> /dev/null; do sleep 0.1; done > /dev/null +cryptsetup open $(findfs UUID=$UUID) _key +mount -o ro "/dev/mapper/_key" /key |