2020-04-24 23:36:52 +00:00
|
|
|
{ config, lib, pkgs, utils, ... }:
|
|
|
|
|
|
|
|
let
|
|
|
|
|
2024-01-02 11:29:13 +00:00
|
|
|
bootFs = lib.filterAttrs (n: fs: (fs.fsType == "bcachefs") && (utils.fsNeededForBoot fs)) config.fileSystems;
|
2020-04-24 23:36:52 +00:00
|
|
|
|
|
|
|
commonFunctions = ''
|
|
|
|
prompt() {
|
|
|
|
local name="$1"
|
|
|
|
printf "enter passphrase for $name: "
|
|
|
|
}
|
2023-11-16 04:20:00 +00:00
|
|
|
|
2020-04-24 23:36:52 +00:00
|
|
|
tryUnlock() {
|
|
|
|
local name="$1"
|
|
|
|
local path="$2"
|
2023-11-16 04:20:00 +00:00
|
|
|
local success=false
|
|
|
|
local target
|
|
|
|
local uuid=$(echo -n $path | sed -e 's,UUID=\(.*\),\1,g')
|
|
|
|
|
|
|
|
printf "waiting for device to appear $path"
|
|
|
|
for try in $(seq 10); do
|
|
|
|
if [ -e $path ]; then
|
2024-01-02 11:29:13 +00:00
|
|
|
target=$(readlink -f $path)
|
2023-11-16 04:20:00 +00:00
|
|
|
success=true
|
|
|
|
break
|
|
|
|
else
|
|
|
|
target=$(blkid --uuid $uuid)
|
|
|
|
if [ $? == 0 ]; then
|
|
|
|
success=true
|
|
|
|
break
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
echo -n "."
|
|
|
|
sleep 1
|
|
|
|
done
|
|
|
|
printf "\n"
|
|
|
|
if [ $success == true ]; then
|
|
|
|
path=$target
|
|
|
|
fi
|
|
|
|
|
2020-04-24 23:36:52 +00:00
|
|
|
if bcachefs unlock -c $path > /dev/null 2> /dev/null; then # test for encryption
|
|
|
|
prompt $name
|
2023-05-24 13:37:59 +00:00
|
|
|
until bcachefs unlock $path 2> /dev/null; do # repeat until successfully unlocked
|
2020-04-24 23:36:52 +00:00
|
|
|
printf "unlocking failed!\n"
|
|
|
|
prompt $name
|
|
|
|
done
|
|
|
|
printf "unlocking successful.\n"
|
2023-11-16 04:20:00 +00:00
|
|
|
else
|
|
|
|
echo "Cannot unlock device $uuid with path $path" >&2
|
2020-04-24 23:36:52 +00:00
|
|
|
fi
|
|
|
|
}
|
|
|
|
'';
|
|
|
|
|
2023-11-16 04:20:00 +00:00
|
|
|
# we need only unlock one device manually, and cannot pass multiple at once
|
|
|
|
# remove this adaptation when bcachefs implements mounting by filesystem uuid
|
|
|
|
# also, implement automatic waiting for the constituent devices when that happens
|
|
|
|
# bcachefs does not support mounting devices with colons in the path, ergo we don't (see #49671)
|
2024-01-02 11:29:13 +00:00
|
|
|
firstDevice = fs: lib.head (lib.splitString ":" fs.device);
|
|
|
|
|
|
|
|
openCommand = name: fs: if config.boot.initrd.clevis.enable && (lib.hasAttr (firstDevice fs) config.boot.initrd.clevis.devices) then ''
|
|
|
|
if clevis decrypt < /etc/clevis/${firstDevice fs}.jwe | bcachefs unlock ${firstDevice fs}
|
|
|
|
then
|
|
|
|
printf "unlocked ${name} using clevis\n"
|
|
|
|
else
|
|
|
|
printf "falling back to interactive unlocking...\n"
|
|
|
|
tryUnlock ${name} ${firstDevice fs}
|
|
|
|
fi
|
|
|
|
'' else ''
|
2023-11-16 04:20:00 +00:00
|
|
|
tryUnlock ${name} ${firstDevice fs}
|
|
|
|
'';
|
|
|
|
|
|
|
|
mkUnits = prefix: name: fs: let
|
|
|
|
mountUnit = "${utils.escapeSystemdPath (prefix + (lib.removeSuffix "/" fs.mountPoint))}.mount";
|
|
|
|
device = firstDevice fs;
|
|
|
|
deviceUnit = "${utils.escapeSystemdPath device}.device";
|
|
|
|
in {
|
|
|
|
name = "unlock-bcachefs-${utils.escapeSystemdPath fs.mountPoint}";
|
|
|
|
value = {
|
|
|
|
description = "Unlock bcachefs for ${fs.mountPoint}";
|
|
|
|
requiredBy = [ mountUnit ];
|
|
|
|
after = [ deviceUnit ];
|
2024-01-02 11:29:13 +00:00
|
|
|
before = [ mountUnit "shutdown.target" ];
|
|
|
|
bindsTo = [ deviceUnit ];
|
|
|
|
conflicts = [ "shutdown.target" ];
|
2023-11-16 04:20:00 +00:00
|
|
|
unitConfig.DefaultDependencies = false;
|
|
|
|
serviceConfig = {
|
|
|
|
Type = "oneshot";
|
|
|
|
ExecCondition = "${pkgs.bcachefs-tools}/bin/bcachefs unlock -c \"${device}\"";
|
|
|
|
Restart = "on-failure";
|
|
|
|
RestartMode = "direct";
|
|
|
|
# Ideally, this service would lock the key on stop.
|
|
|
|
# As is, RemainAfterExit doesn't accomplish anything.
|
|
|
|
RemainAfterExit = true;
|
|
|
|
};
|
|
|
|
script = ''
|
|
|
|
${config.boot.initrd.systemd.package}/bin/systemd-ask-password --timeout=0 "enter passphrase for ${name}" | exec ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${device}"
|
2020-04-24 23:36:52 +00:00
|
|
|
'';
|
2023-11-16 04:20:00 +00:00
|
|
|
};
|
|
|
|
};
|
2020-04-24 23:36:52 +00:00
|
|
|
|
2024-01-02 11:29:13 +00:00
|
|
|
assertions = [
|
|
|
|
{
|
|
|
|
assertion = let
|
|
|
|
kernel = config.boot.kernelPackages.kernel;
|
|
|
|
in (
|
|
|
|
kernel.kernelAtLeast "6.7" || (
|
|
|
|
lib.elem (kernel.structuredExtraConfig.BCACHEFS_FS or null) [
|
|
|
|
lib.kernel.module
|
|
|
|
lib.kernel.yes
|
|
|
|
(lib.kernel.option lib.kernel.yes)
|
|
|
|
]
|
|
|
|
)
|
|
|
|
);
|
|
|
|
|
|
|
|
message = "Linux 6.7-rc1 at minimum or a custom linux kernel with bcachefs support is required";
|
|
|
|
}
|
|
|
|
];
|
2020-04-24 23:36:52 +00:00
|
|
|
in
|
|
|
|
|
|
|
|
{
|
2024-01-02 11:29:13 +00:00
|
|
|
config = lib.mkIf (lib.elem "bcachefs" config.boot.supportedFilesystems) (lib.mkMerge [
|
2020-04-24 23:36:52 +00:00
|
|
|
{
|
2024-01-02 11:29:13 +00:00
|
|
|
inherit assertions;
|
2023-11-16 04:20:00 +00:00
|
|
|
# needed for systemd-remount-fs
|
|
|
|
system.fsPackages = [ pkgs.bcachefs-tools ];
|
2020-04-24 23:36:52 +00:00
|
|
|
|
2024-01-02 11:29:13 +00:00
|
|
|
# FIXME: Replace this with `linuxPackages_testing` after NixOS 23.11 is released
|
|
|
|
# FIXME: Replace this with `linuxPackages_latest` when 6.7 is released, remove this line when the LTS version is at least 6.7
|
|
|
|
boot.kernelPackages = lib.mkDefault (
|
|
|
|
# FIXME: Remove warning after NixOS 23.11 is released
|
|
|
|
lib.warn "Please upgrade to Linux 6.7-rc1 or later: 'linuxPackages_testing_bcachefs' is deprecated. Use 'boot.kernelPackages = pkgs.linuxPackages_testing;' to silence this warning"
|
|
|
|
pkgs.linuxPackages_testing_bcachefs
|
|
|
|
);
|
2023-11-16 04:20:00 +00:00
|
|
|
|
|
|
|
systemd.services = lib.mapAttrs' (mkUnits "") (lib.filterAttrs (n: fs: (fs.fsType == "bcachefs") && (!utils.fsNeededForBoot fs)) config.fileSystems);
|
2020-04-24 23:36:52 +00:00
|
|
|
}
|
|
|
|
|
2024-01-02 11:29:13 +00:00
|
|
|
(lib.mkIf ((lib.elem "bcachefs" config.boot.initrd.supportedFilesystems) || (bootFs != {})) {
|
|
|
|
inherit assertions;
|
2020-12-27 14:24:52 +00:00
|
|
|
# chacha20 and poly1305 are required only for decryption attempts
|
|
|
|
boot.initrd.availableKernelModules = [ "bcachefs" "sha256" "chacha20" "poly1305" ];
|
2023-01-11 07:51:40 +00:00
|
|
|
boot.initrd.systemd.extraBin = {
|
2023-11-16 04:20:00 +00:00
|
|
|
# do we need this? boot/systemd.nix:566 & boot/systemd/initrd.nix:357
|
2023-01-11 07:51:40 +00:00
|
|
|
"bcachefs" = "${pkgs.bcachefs-tools}/bin/bcachefs";
|
2023-11-16 04:20:00 +00:00
|
|
|
"mount.bcachefs" = "${pkgs.bcachefs-tools}/bin/mount.bcachefs";
|
2023-01-11 07:51:40 +00:00
|
|
|
};
|
|
|
|
boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
|
2020-04-24 23:36:52 +00:00
|
|
|
copy_bin_and_libs ${pkgs.bcachefs-tools}/bin/bcachefs
|
2023-11-16 04:20:00 +00:00
|
|
|
copy_bin_and_libs ${pkgs.bcachefs-tools}/bin/mount.bcachefs
|
2020-04-24 23:36:52 +00:00
|
|
|
'';
|
2023-11-16 04:20:00 +00:00
|
|
|
boot.initrd.extraUtilsCommandsTest = lib.mkIf (!config.boot.initrd.systemd.enable) ''
|
2020-04-24 23:36:52 +00:00
|
|
|
$out/bin/bcachefs version
|
|
|
|
'';
|
|
|
|
|
2024-01-02 11:29:13 +00:00
|
|
|
boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable) (commonFunctions + lib.concatStrings (lib.mapAttrsToList openCommand bootFs));
|
2023-11-16 04:20:00 +00:00
|
|
|
|
|
|
|
boot.initrd.systemd.services = lib.mapAttrs' (mkUnits "/sysroot") bootFs;
|
2020-04-24 23:36:52 +00:00
|
|
|
})
|
|
|
|
]);
|
|
|
|
}
|