Remote disk unlocking: Difference between revisions

← Older edit

VisualWikitext

@@ Line 3: / Line 3: @@
 == Setup ==
-Generate host key for the SSH daemon which will run in initrd during boot (required)
+=== Add kernel modules for the network card ===
+The network card may not work in initrd without its kernel being manually loaded by {{nixos:option|boot.initrd.availableKernelModules}}. Find out the kernel module required by   checking "Kernel modules" section in the output of <code>lspci -v | grep -iA8 'network\|ethernet'</code> (<code>lspci</code> is available in {{nixos:package|pciutils}}), and add it to {{nixos:option|boot.initrd.availableKernelModules}} (not to confuse with {{nixos:option|boot.availableKernelModules}}, which is for stage 2).
+{{file|/etc/nixos/configuration.nix|nix|<nowiki>
+boot.initrd.availableKernelModules = [ ... ];
+</nowiki>}}
+=== Generate host key ===
+Generate host key for the SSH daemon in <code>/etc/secrets/initrd/ssh_host_ed25519_key</code> which is required.
 <syntaxhighlight lang="console">
@@ Line 9: / Line 19: @@
 # ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key
 </syntaxhighlight>
+=== Configure SSH ===
+Configure {{nixos:option|boot.initrd.network.ssh}}. Add the generated host key to {{nixos:option|boot.initrd.network.ssh.hostKeys}} and your public key to {{nixos:option|boot.initrd.network.ssh.authorizedKeys}}.
+{{file|/etc/nixos/configuration.nix|nix|<nowiki>boot.initrd.network = {
+  enable = true;
+  ssh = {
+    enable = true;
+    hostKeys = [
+      "/etc/secrets/initrd/ssh_host_ed25519_key"
+    ];
+    authorizedKeys = [
+      "ssh-rsa AAAAyourpublic-key-here...";
+    ];
+  };
+};
+</nowiki>}}
+Now proceed to one of [[#Setup with Systemd]] or [[#Setup without Systemd]].
+== Setup with Systemd ==
+=== Configure systemd-networkd ===
+{{nixos:option|boot.initrd.systemd.network}} has a syntax similar to {{nixos:option|systemd.network}}. For details, see [[Systemd/networkd]].
+First find the interface name(s) (<code>eth0</code> in this example):
+<syntaxhighlight lang="console">
+# ip addr
+lo ...
+eth0 ...
+</syntaxhighlight>
+To configure DHCP:
+{{file|/etc/nixos/configuration.nix|nix|3=<nowiki>
+boot.initrd.systemd.network = {
+  enable = true;
+  networks."10-eth0" = {
+    matchConfig.Name = "eth0";
+    networkConfig.DHCP = "ipv4";
+    # Wait until network interfaces have a routable address
+    # https://wiki.archlinux.org/title/Systemd-networkd
+    linkConfig.RequiredForOnline = "routable";
+  };
+};</nowiki>|name=/etc/nixos/configuration.nix|lang=nix}}
+To configure static IP:
+{{file|/etc/nixos/configuration.nix|nix|<nowiki>boot.initrd.systemd.network = {
+  enable = true;
+  networks."10-eth0" = {
+    matchConfig.Name = "eth0";
+    address = [
+      "192.168.1.123/24"
+      "2001:db8:1234:5678::1/64"
+    ];
+    routes = [
+      { Gateway = "192.168.1.1"; }
+      { Gateway = "fe80::1"; }
+    ];
+    # Wait until network interfaces have a routable address
+    # https://wiki.archlinux.org/title/Systemd-networkd
+    linkConfig.RequiredForOnline = "routable";
+  };
+};
+</nowiki>}}
+=== Debug shell ===
+Enable debug shell. Although it is not required, enabling the debug shell allows you to enter the debug shell by press <code>Ctrl+Alt+F9</code> during Stage 1.
+{{file|/etc/nixos/configuration.nix|nix|<nowiki>
+boot.kernelParams = [ "rd.systemd.debug_shell=1" ];
+</nowiki>}}
+The network and SSH status can be checked from within the debug shell:
+<syntaxhighlight lang="console">
+# networkctl status: show systemd-networkd status
+# journalctl -u sshd
+# cat /etc/ssh/sshd_config
+</syntaxhighlight>
+=== Automatic password prompt ===
+To automatically be prompted for a password when logging in via SSH, add <code>command="systemctl default"</code> to {{nixos:option|boot.initrd.network.ssh.authorizedKeys}}.
+{{file|/etc/nixos/configuration.nix|diff|<nowiki>
+boot.initrd.network = {
+  enable = true;
+  ssh = {
+    enable = true;
+    hostKeys = [
+      "/etc/secrets/initrd/ssh_host_ed25519_key"
+    ];
+    authorizedKeys = [
+-      "ssh-rsa AAAAyourpublic-key-here...";
++      ''command="systemctl default" ssh-rsa AAAAyourpublic-key-here...''
+    ];
+  };
+};
+</nowiki>}}
+== Setup without Systemd ==
 Enable SSH daemon in initrd
@@ Line 14: / Line 131: @@
 {{file|/etc/nixos/configuration.nix|nix|<nowiki>
 boot.initrd = {
+  systemd.enable = false;
    availableKernelModules = [ "r8169" ];
    network = {
@@ Line 52: / Line 170: @@
 If you omit it, you will get dropped into <code>/bin/ash</code>, and you will have to manually run <code>cryptsetup-askpass</code> to enter the password. Alternatively, the <code>boot.initrd.systemd.users.root.shell</code> option can be set to <code>/bin/conspy</code> for passwords which expect stdin. This binary included by default, and provided by busybox.
-Since 26.05 release, initrd is based on systemd by default. systemd-networkd must be used instead of NetworkManager, otherwise network will fail to initialize.
-{{file|/etc/nixos/configuration.nix|nix|3=boot.initrd.systemd.network = {
-  enable = true;
-  networks."eth0" = {
-    matchConfig.Name = "eth0";
-    networkConfig.DHCP = "ipv4";
-  };
-};
-networking.networkmanager.enable = false;
-systemd.network = {
-  enable = true;
-  networks."eth0" = {
-    matchConfig.Name = "eth0";
-    networkConfig.DHCP = "ipv4";
-  };
-};|name=/etc/nixos/configuration.nix|lang=nix}}
 == Usage ==