Remote disk unlocking: Difference between revisions
mNo edit summary |
Add setup for systemd based initrd |
||
| (One intermediate revision by the same user not shown) | |||
| Line 3: | Line 3: | ||
== Setup == | == Setup == | ||
=== Add kernel modules for the network card === | |||
The network card may not work in initrd without its kernel being manually loaded by {{nixos:option|boot.initrd.availableKernelModules}}. Find out the kernel module required by checking "Kernel modules" section in the output of <code>lspci -v | grep -iA8 'network\|ethernet'</code> (<code>lspci</code> is available in {{nixos:package|pciutils}}), and add it to {{nixos:option|boot.initrd.availableKernelModules}} (not to confuse with {{nixos:option|boot.availableKernelModules}}, which is for stage 2). | |||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | {{file|/etc/nixos/configuration.nix|nix|<nowiki> | ||
| Line 9: | Line 11: | ||
</nowiki>}} | </nowiki>}} | ||
=== Generate host key === | |||
Generate host key for the SSH daemon in <code>/etc/secrets/initrd/ssh_host_ed25519_key</code> which is required. | |||
<syntaxhighlight lang="console"> | <syntaxhighlight lang="console"> | ||
| Line 16: | Line 20: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
=== Configure SSH === | |||
Configure {{nixos:option|boot.initrd.network.ssh}}. Add the generated host key to {{nixos:option|boot.initrd.network.ssh.hostKeys}} and your public key to {{nixos:option|boot.initrd.network.ssh.authorizedKeys}}. | |||
{{file|/etc/nixos/configuration.nix|nix|<nowiki>boot.initrd.network = { | {{file|/etc/nixos/configuration.nix|nix|<nowiki>boot.initrd.network = { | ||
| Line 36: | Line 42: | ||
== Setup with Systemd == | == Setup with Systemd == | ||
=== Configure systemd-networkd === | |||
{{nixos:option|boot.initrd.systemd.network}} has a syntax similar to {{nixos:option|systemd.network}}. For details, see [[Systemd/networkd]]. | |||
First find the interface name(s) (<code>eth0</code> in this example): | First find the interface name(s) (<code>eth0</code> in this example): | ||
| Line 79: | Line 73: | ||
enable = true; | enable = true; | ||
networks."10-eth0" = { | networks."10-eth0" = { | ||
matchConfig.Name = "eth0"; | |||
matchConfig.Name = " | |||
address = [ | address = [ | ||
"192.168.1.123/24" | "192.168.1.123/24" | ||
| Line 96: | Line 89: | ||
</nowiki>}} | </nowiki>}} | ||
=== Debug shell === | |||
Enable debug shell. Although it is not required, enabling the debug shell allows you to enter the debug shell by press <code>Ctrl+Alt+F9</code> during Stage 1. | |||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | |||
boot.kernelParams = [ "rd.systemd.debug_shell=1" ]; | |||
</nowiki>}} | |||
The network and SSH status can be checked from within the debug shell: | |||
<syntaxhighlight lang="console"> | |||
# networkctl status: show systemd-networkd status | |||
# journalctl -u sshd | |||
# cat /etc/ssh/sshd_config | |||
</syntaxhighlight> | |||
=== Automatic password prompt === | |||
To automatically be prompted for a password when logging in via SSH, add <code>command="systemctl default"</code> to {{nixos:option|boot.initrd.network.ssh.authorizedKeys}}. | |||
{{file|/etc/nixos/configuration.nix|diff|<nowiki> | {{file|/etc/nixos/configuration.nix|diff|<nowiki> | ||