Remote disk unlocking - Revision history

Arnecc: /* Remote bcachefs unlocking */

2026-08-05T10:42:09Z

Remote bcachefs unlocking

← Older revision		Revision as of 10:42, 5 August 2026
Line 199:		Line 199:
	initrdBin = with pkgs; [ keyutils ];		initrdBin = with pkgs; [ keyutils ];
	extraBin = {		extraBin = {
	"systemd-tty-ask-password-agent" = "${pkgs.systemd~~}/bin/~~systemd-tty-ask-password-agent";		"systemd-tty-ask-password-agent" = "${lib.getExe' pkgs.systemd "systemd-tty-ask-password-agent"}";
	"bcachefs-unlock-shell" = "${unlockShell}~~/bin/bcachefs-unlock-shell~~";		"bcachefs-unlock-shell" = "${lib.getExe unlockShell}";
	};		};
	users.root.shell = "/bin/bcachefs-unlock-shell";		users.root.shell = "/bin/bcachefs-unlock-shell";

Arnecc: updated remote unlocking / removed non functional legacy setup

2026-08-05T10:28:32Z

updated remote unlocking / removed non functional legacy setup

@@ Line 183: / Line 183: @@
 == Tips and tricks ==
-=== Bcachefs unlocking ===
+=== Remote bcachefs unlocking ===
-Unlocking encrypted Bcachefs root filesystems is [https://github.com/NixOS/nixpkgs/issues/291529 not yet supported]. As a workaround, following script, in combination with the setup above, can be used as SSH shell, to unlock the disk <code>/dev/vda2</code>.
+Starting with NixOS 26.05, the bcachefs module (boot.supportedFilesystems = [ "bcachefs" ]) automatically creates an unlock-bcachefs-<mountpoint>.service in the systemd initrd for boot-critical bcachefs filesystems. This service calls systemd-ask-password and pipes the response to bcachefs unlock, running before the generated sysroot.mount unit.
 For remote unlocking via SSH, set the initrd root shell to systemd-tty-ask-password-agent --watch, which picks up the pending password request and displays the prompt over the SSH connection. The agent must be added to the initrd's /bin via extraBin, as it is not included by default.

Arnecc: /* Bcachefs unlocking */

2026-08-05T10:23:15Z

Bcachefs unlocking

← Older revision		Revision as of 10:23, 5 August 2026
Line 206:		Line 206:

	Using systemd in initrd automatically continues the boot process after the target <code>/sysroot</code> is mounted.		Using systemd in initrd automatically continues the boot process after the target <code>/sysroot</code> is mounted.

			'''Starting with NixOS 26.05''', the bcachefs module (boot.supportedFilesystems = [ "bcachefs" ]) automatically creates an unlock-bcachefs-<mountpoint>.service in the systemd initrd for boot-critical bcachefs filesystems. This service calls systemd-ask-password and pipes the response to bcachefs unlock, running before the generated sysroot.mount unit.

			For remote unlocking via SSH, set the initrd root shell to systemd-tty-ask-password-agent --watch, which picks up the pending password request and displays the prompt over the SSH connection. The agent must be added to the initrd's /bin via extraBin, as it is not included by default.

			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			boot.initrd.systemd = let
			unlockShell = pkgs.writeShellScriptBin "bcachefs-unlock-shell" ''
			keyctl link @u @s 2>/dev/null \|\| true
			exec systemd-tty-ask-password-agent --watch
			'';
			in {
			enable = true;
			initrdBin = with pkgs; [ keyutils ];
			extraBin = {
			"systemd-tty-ask-password-agent" = "${pkgs.systemd}/bin/systemd-tty-ask-password-agent";
			"bcachefs-unlock-shell" = "${unlockShell}/bin/bcachefs-unlock-shell";
			};
			users.root.shell = "/bin/bcachefs-unlock-shell";
			};
			</nowiki>}}

	=== Wireguard in initrd ===		=== Wireguard in initrd ===

Bryq: Update the configuration for tor in initrd with systemd stage1.

2026-07-19T19:43:04Z

Update the configuration for tor in initrd with systemd stage1.

@@ Line 240: / Line 240: @@
 === Tor in initrd ===
 ==== Prepare the Onion ID ====
@@ Line 252: / Line 250: @@
 To create these files:
-  $ nix-shell -p mkp224o --command "mkp224o-donna snow -n 1 -d ."
+  $ nix-shell -p mkp224o --command "mkp224o-donna a -n 1 -d ."
   set workdir: ./
   nixuum6flqthv6ar52j5e2ldulylfsfgezykeg37iy74kqowcp5gxfyd.onion
@@ Line 259: / Line 257: @@
   hostname  hs_ed25519_public_key  hs_ed25519_secret_key
-==== Setup Tor ====
+==== Setup Tor (systemd stage1, since NixOS 26.05) ====
-Now that you have your 3 files, you have to script a bit, but it’s not too complicated.
+Now that you have your 3 files, you have to script a bit, but it’s not too complicated. The snippet is adapted from [https://cgit.euer.krebsco.de/makefu/stockholm/src/commit/9b1008814e981dc01afe9ee7446322ad512c1d72/krebs/2configs/tor/initrd.nix krebs/2configs/tor/initrd.nix in stockholm].
 <syntaxhighlight lang="nix"># copy your onion folder

34j: Add setup for systemd based initrd

2026-07-02T07:57:43Z

Add setup for systemd based initrd

← Older revision		Revision as of 07:57, 2 July 2026
Line 3:		Line 3:
	== Setup ==		== Setup ==

	1. The network card may not work in initrd without its kernel being manually loaded by {{nixos:option\|boot.initrd.availableKernelModules}}. Find out the kernel module required by checking "Kernel modules" section in the output of <code>lspci -v \| grep -iA8 'network\\|ethernet'</code> (<code>lspci</code> is available in {{nixos:package\|pciutils}}), and add it to {{nixos:option\|boot.initrd.availableKernelModules}} (not to confuse with {{nixos:option\|boot.availableKernelModules}}, which is for stage 2).		=== Add kernel modules for the network card ===

			The network card may not work in initrd without its kernel being manually loaded by {{nixos:option\|boot.initrd.availableKernelModules}}. Find out the kernel module required by checking "Kernel modules" section in the output of <code>lspci -v \| grep -iA8 'network\\|ethernet'</code> (<code>lspci</code> is available in {{nixos:package\|pciutils}}), and add it to {{nixos:option\|boot.initrd.availableKernelModules}} (not to confuse with {{nixos:option\|boot.availableKernelModules}}, which is for stage 2).

	{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
Line 9:		Line 11:
	</nowiki>}}		</nowiki>}}

	2. Generate host key for the SSH daemon in <code>/etc/secrets/initrd/ssh_host_ed25519_key</code> which is required.		=== Generate host key ===

			Generate host key for the SSH daemon in <code>/etc/secrets/initrd/ssh_host_ed25519_key</code> which is required.

	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
Line 16:		Line 20:
	</syntaxhighlight>		</syntaxhighlight>

	3. Configure {{nixos:option\|boot.initrd.network.ssh}}. Add the generated host key to {{nixos:option\|boot.initrd.network.ssh.hostKeys}} and your public key to {{nixos:option\|boot.initrd.network.ssh.authorizedKeys}}.		=== Configure SSH ===

			Configure {{nixos:option\|boot.initrd.network.ssh}}. Add the generated host key to {{nixos:option\|boot.initrd.network.ssh.hostKeys}} and your public key to {{nixos:option\|boot.initrd.network.ssh.authorizedKeys}}.

	{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>boot.initrd.network = {		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>boot.initrd.network = {
Line 36:		Line 42:
	== Setup with Systemd ==		== Setup with Systemd ==

	~~1. Enable debug shell. Although it is not required, enabling the debug shell allows you to enter the debug shell by press <code>Ctrl+Alt+F9</code> during Stage 1.~~		=== Configure systemd-networkd ===

	~~{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>~~
	~~boot.kernelParams~~ = ~~[ "rd.systemd.debug_shell~~=~~1" ];~~
	~~</nowiki>}}~~

	~~The network and SSH status can be checked from within the debug shell:~~

	~~<syntaxhighlight lang~~=~~"console">~~
	~~# networkctl status: show~~ systemd-networkd ~~status~~
	~~# journalctl -u sshd~~
	~~# cat /etc/ssh/sshd_config~~
	~~</syntaxhighlight>~~

	~~2. Configure [[Systemd/networkd]].~~ {{nixos:option\|boot.initrd.systemd.network}} has a syntax similar to {{nixos:option\|systemd.network}}. For details, see [[Systemd/networkd]].		{{nixos:option\|boot.initrd.systemd.network}} has a syntax similar to {{nixos:option\|systemd.network}}. For details, see [[Systemd/networkd]].

	First find the interface name(s) (<code>eth0</code> in this example):		First find the interface name(s) (<code>eth0</code> in this example):
Line 95:		Line 89:
	</nowiki>}}		</nowiki>}}

	3. To automatically be prompted for a password when logging in via SSH, add <code>command="systemctl default"</code> to {{nixos:option\|boot.initrd.network.ssh.authorizedKeys}}.		=== Debug shell ===

			Enable debug shell. Although it is not required, enabling the debug shell allows you to enter the debug shell by press <code>Ctrl+Alt+F9</code> during Stage 1.

			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			boot.kernelParams = [ "rd.systemd.debug_shell=1" ];
			</nowiki>}}

			The network and SSH status can be checked from within the debug shell:

			<syntaxhighlight lang="console">
			# networkctl status: show systemd-networkd status
			# journalctl -u sshd
			# cat /etc/ssh/sshd_config
			</syntaxhighlight>

			=== Automatic password prompt ===

			To automatically be prompted for a password when logging in via SSH, add <code>command="systemctl default"</code> to {{nixos:option\|boot.initrd.network.ssh.authorizedKeys}}.

	{{file\|/etc/nixos/configuration.nix\|diff\|<nowiki>		{{file\|/etc/nixos/configuration.nix\|diff\|<nowiki>

34j at 07:51, 2 July 2026

2026-07-02T07:51:00Z

← Older revision		Revision as of 07:51, 2 July 2026
Line 79:		Line 79:
	enable = true;		enable = true;
	networks."10-eth0" = {		networks."10-eth0" = {
	~~# Run `ip addr` to find the interface name to specify, e.g. enp5s0~~		matchConfig.Name = "eth0";
	matchConfig.Name = "~~enp5s0~~";
	address = [		address = [
	"192.168.1.123/24"		"192.168.1.123/24"

34j at 07:49, 2 July 2026

2026-07-02T07:49:41Z

← Older revision		Revision as of 07:49, 2 July 2026
Line 18:		Line 18:
	3. Configure {{nixos:option\|boot.initrd.network.ssh}}. Add the generated host key to {{nixos:option\|boot.initrd.network.ssh.hostKeys}} and your public key to {{nixos:option\|boot.initrd.network.ssh.authorizedKeys}}.		3. Configure {{nixos:option\|boot.initrd.network.ssh}}. Add the generated host key to {{nixos:option\|boot.initrd.network.ssh.hostKeys}} and your public key to {{nixos:option\|boot.initrd.network.ssh.authorizedKeys}}.

	{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>boot.initrd.network = {
	boot.initrd.network = {
	enable = true;		enable = true;
	ssh = {		ssh = {
Line 63:		Line 62:
	To configure DHCP:		To configure DHCP:

	{{file\|/etc/nixos/configuration.nix\|nix\|3=boot.initrd.systemd.network = {		{{file\|/etc/nixos/configuration.nix\|nix\|3=<nowiki>
			boot.initrd.systemd.network = {
	enable = true;		enable = true;
	networks."10-eth0" = {		networks."10-eth0" = {
Line 72:		Line 72:
	linkConfig.RequiredForOnline = "routable";		linkConfig.RequiredForOnline = "routable";
	};		};
	};\|name=/etc/nixos/configuration.nix\|lang=nix}}		};</nowiki>\|name=/etc/nixos/configuration.nix\|lang=nix}}

	To configure static IP:		To configure static IP:
Line 94:		Line 94:
	};		};
	};		};
			</nowiki>}}

	3. To automatically be prompted for a password when logging in via SSH, add <code>command="systemctl default"</code> to {{nixos:option\|boot.initrd.network.ssh.authorizedKeys}}.		3. To automatically be prompted for a password when logging in via SSH, add <code>command="systemctl default"</code> to {{nixos:option\|boot.initrd.network.ssh.authorizedKeys}}.

34j: Add setup for systemd based initrd

2026-07-02T07:47:55Z

Add setup for systemd based initrd

Show changes

Golbinex: /* Setup */

2026-06-02T20:50:04Z

Setup

← Older revision		Revision as of 20:50, 2 June 2026
Line 57:		Line 57:
	enable = true;		enable = true;
	networks."eth0" = {		networks."eth0" = {
	~~name~~ = "eth0";		matchConfig.Name = "eth0";
	DHCP = "~~yes~~";		networkConfig.DHCP = "ipv4";
	};		};
	};		};

Golbinex: /* Setup */

2026-06-02T20:48:25Z

Setup

← Older revision		Revision as of 20:48, 2 June 2026
Line 56:		Line 56:
	{{file\|/etc/nixos/configuration.nix\|nix\|3=boot.initrd.systemd.network = {		{{file\|/etc/nixos/configuration.nix\|nix\|3=boot.initrd.systemd.network = {
	enable = true;		enable = true;
	networks."~~wan~~" = {		networks."eth0" = {
	name = "eth0";		name = "eth0";
	DHCP = "yes";		DHCP = "yes";
Line 65:		Line 65:
	systemd.network = {		systemd.network = {
	enable = true;		enable = true;
	networks."~~wan~~" = {		networks."eth0" = {
	matchConfig.Name = "eth0";		matchConfig.Name = "eth0";
	networkConfig.DHCP = "ipv4";		networkConfig.DHCP = "ipv4";