Official NixOS Wiki

Bcachefs: Difference between revisions

← Older edit
Onny (talk | contribs)
389 edits
VisualWikitext
Onny (talk | contribs)
389 edits
→NixOS installation on bcachefs: Cleanup instruction
Onny (talk | contribs)
389 edits
 
(One intermediate revision by the same user not shown)
Line 36: Line 36:


<syntaxhighlight lang="console">
<syntaxhighlight lang="console">
# bcachefs format --encrypt /dev/sda
# bcachefs format --encrypted /dev/sda
# bcachefs unlock /dev/sda
# bcachefs unlock /dev/sda
# mount -t bcachefs /dev/sda /mnt
# mount -t bcachefs /dev/sda /mnt
Line 192: Line 192:


=== Automatically mount encrypted device on boot ===
=== Automatically mount encrypted device on boot ===
Since the Bcachefs mount options do [https://github.com/koverstreet/bcachefs-tools/pull/266 not support supplying a key file yet], we could use the <code>bcachefs</code> command and run it on boot using a [[Systemd]] unit:<syntaxhighlight lang="nix">
Since the Bcachefs mount options do [https://github.com/koverstreet/bcachefs-tools/pull/266 not support supplying a key file yet], we could use the <code>bcachefs unlock</code> command and run it on boot using a [[Systemd]] unit:<syntaxhighlight lang="nix">fileSystems."/mnt" = {
systemd.services."bcachefs-mount" = {
   device = "/dev/disk/by-uuid/3c0d7d93-3293-49a3-842e-d9ef77576d97";
   after = [ "local-fs.target" ];
   fsType = "bcachefs";
   wantedBy = [ "multi-user.target" ];
   options = [ "nofail" ];
   environment = {
};
    DEVICE_PATH = "/dev/sda1";
    MOUNT_POINT = "/mnt";
  };
  script = ''
    #!${pkgs.runtimeShell} -e


    ${pkgs.keyutils}/bin/keyctl link @u @s
# Ensure to match the correct systemd unit name which gets created by NixOS
 
# in the first place. We override the script part.
    # Check if the device path exists
systemd.services."unlock-bcachefs-mnt" = {
    if [ ! -b "$DEVICE_PATH" ]; then
  serviceConfig.LoadCredential = [ "bcachefs-mnt:/etc/secret.key" ];
      echo "Error: Device path $DEVICE_PATH does not exist."
  script = lib.mkForce ''
      exit 1
     ${lib.getExe' pkgs.keyutils "keyctl"} link @u @s
    fi
    ${config.boot.initrd.systemd.package}/bin/systemd-ask-password --credential=bcachefs-mnt --timeout=0 "enter passphrase for /mnt" | \
 
       exec ${lib.getExe pkgs.bcachefs-tools} unlock \
    # Check if the drive is already mounted
      "/dev/disk/by-uuid/3c0d7d93-3293-49a3-842e-d9ef77576d97"
     if ${pkgs.util-linux}/bin/mountpoint -q "$MOUNT_POINT"; then
      echo "Drive already mounted at $MOUNT_POINT. Skipping..."
      exit 0
    fi
 
    # Wait for the device to become available
    while [ ! -b "$DEVICE_PATH" ]; do
      echo "Waiting for $DEVICE_PATH to become available..."
       sleep 5
    done
 
    # Mount the device
    ${pkgs.bcachefs-tools}/bin/bcachefs mount -f /etc/keyfile_test "$DEVICE_PATH" "$MOUNT_POINT"
   '';
   '';
  serviceConfig = {
};</syntaxhighlight>This example unit unlocks the Bcachefs encrypted partition <code>/dev/disk/by-uuid/3c0d7d93-3293-49a3-842e-d9ef77576d97</code> whereas the fstab entry mounts it to the target <code>/mnt</code> by using the key file <code>/etc/secret.key</code>. Ensure that you replace all disk uuid and target file path occurences.
    Type = "oneshot";
    User = "root";
  };
};
</syntaxhighlight>This example unit mounts the Bcachefs encrypted partition <code>/dev/sda1</code> to the target <code>/mnt</code> by using the key file <code>/etc/keyfile_test</code>.
[[Category:Filesystem]]
[[Category:Filesystem]]
Retrieved from "https://wiki.nixos.org/wiki/Bcachefs"