luksroot module: optionSet -> submodule
This commit is contained in:
Eric Sagnes
parent
55e437806a
commit
96f5788346
@ -236,165 +236,165 @@ in
|
|||||||
<filename>/dev/mapper/<replaceable>name</replaceable></filename>.
|
<filename>/dev/mapper/<replaceable>name</replaceable></filename>.
|
||||||
'';
|
'';
|
||||||
|
|
||||||
type = types.loaOf types.optionSet;
|
type = with types; loaOf (submodule (
|
||||||
|
{ name, ... }: { options = {
|
||||||
|
|
||||||
options = { name, ... }: { options = {
|
name = mkOption {
|
||||||
|
visible = false;
|
||||||
name = mkOption {
|
default = name;
|
||||||
visible = false;
|
example = "luksroot";
|
||||||
default = name;
|
type = types.str;
|
||||||
example = "luksroot";
|
description = "Name of the unencrypted device in <filename>/dev/mapper</filename>.";
|
||||||
type = types.str;
|
|
||||||
description = "Name of the unencrypted device in <filename>/dev/mapper</filename>.";
|
|
||||||
};
|
|
||||||
|
|
||||||
device = mkOption {
|
|
||||||
example = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08";
|
|
||||||
type = types.str;
|
|
||||||
description = "Path of the underlying encrypted block device.";
|
|
||||||
};
|
|
||||||
|
|
||||||
header = mkOption {
|
|
||||||
default = null;
|
|
||||||
example = "/root/header.img";
|
|
||||||
type = types.nullOr types.str;
|
|
||||||
description = ''
|
|
||||||
The name of the file or block device that
|
|
||||||
should be used as header for the encrypted device.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
keyFile = mkOption {
|
|
||||||
default = null;
|
|
||||||
example = "/dev/sdb1";
|
|
||||||
type = types.nullOr types.str;
|
|
||||||
description = ''
|
|
||||||
The name of the file (can be a raw device or a partition) that
|
|
||||||
should be used as the decryption key for the encrypted device. If
|
|
||||||
not specified, you will be prompted for a passphrase instead.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
keyFileSize = mkOption {
|
|
||||||
default = null;
|
|
||||||
example = 4096;
|
|
||||||
type = types.nullOr types.int;
|
|
||||||
description = ''
|
|
||||||
The size of the key file. Use this if only the beginning of the
|
|
||||||
key file should be used as a key (often the case if a raw device
|
|
||||||
or partition is used as key file). If not specified, the whole
|
|
||||||
<literal>keyFile</literal> will be used decryption, instead of just
|
|
||||||
the first <literal>keyFileSize</literal> bytes.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
# FIXME: get rid of this option.
|
|
||||||
preLVM = mkOption {
|
|
||||||
default = true;
|
|
||||||
type = types.bool;
|
|
||||||
description = "Whether the luksOpen will be attempted before LVM scan or after it.";
|
|
||||||
};
|
|
||||||
|
|
||||||
allowDiscards = mkOption {
|
|
||||||
default = false;
|
|
||||||
type = types.bool;
|
|
||||||
description = ''
|
|
||||||
Whether to allow TRIM requests to the underlying device. This option
|
|
||||||
has security implications; please read the LUKS documentation before
|
|
||||||
activating it.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
yubikey = mkOption {
|
|
||||||
default = null;
|
|
||||||
type = types.nullOr types.optionSet;
|
|
||||||
description = ''
|
|
||||||
The options to use for this LUKS device in Yubikey-PBA.
|
|
||||||
If null (the default), Yubikey-PBA will be disabled for this device.
|
|
||||||
'';
|
|
||||||
|
|
||||||
options = {
|
|
||||||
twoFactor = mkOption {
|
|
||||||
default = true;
|
|
||||||
type = types.bool;
|
|
||||||
description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
|
|
||||||
};
|
|
||||||
|
|
||||||
slot = mkOption {
|
|
||||||
default = 2;
|
|
||||||
type = types.int;
|
|
||||||
description = "Which slot on the Yubikey to challenge.";
|
|
||||||
};
|
|
||||||
|
|
||||||
saltLength = mkOption {
|
|
||||||
default = 16;
|
|
||||||
type = types.int;
|
|
||||||
description = "Length of the new salt in byte (64 is the effective maximum).";
|
|
||||||
};
|
|
||||||
|
|
||||||
keyLength = mkOption {
|
|
||||||
default = 64;
|
|
||||||
type = types.int;
|
|
||||||
description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
|
|
||||||
};
|
|
||||||
|
|
||||||
iterationStep = mkOption {
|
|
||||||
default = 0;
|
|
||||||
type = types.int;
|
|
||||||
description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
|
|
||||||
};
|
|
||||||
|
|
||||||
gracePeriod = mkOption {
|
|
||||||
default = 2;
|
|
||||||
type = types.int;
|
|
||||||
description = "Time in seconds to wait before attempting to find the Yubikey.";
|
|
||||||
};
|
|
||||||
|
|
||||||
ramfsMountPoint = mkOption {
|
|
||||||
default = "/crypt-ramfs";
|
|
||||||
type = types.str;
|
|
||||||
description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
|
|
||||||
};
|
|
||||||
|
|
||||||
/* TODO: Add to the documentation of the current module:
|
|
||||||
|
|
||||||
Options related to the storing the salt.
|
|
||||||
*/
|
|
||||||
storage = {
|
|
||||||
device = mkOption {
|
|
||||||
default = "/dev/sda1";
|
|
||||||
type = types.path;
|
|
||||||
description = ''
|
|
||||||
An unencrypted device that will temporarily be mounted in stage-1.
|
|
||||||
Must contain the current salt to create the challenge for this LUKS device.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
fsType = mkOption {
|
|
||||||
default = "vfat";
|
|
||||||
type = types.str;
|
|
||||||
description = "The filesystem of the unencrypted device.";
|
|
||||||
};
|
|
||||||
|
|
||||||
mountPoint = mkOption {
|
|
||||||
default = "/crypt-storage";
|
|
||||||
type = types.str;
|
|
||||||
description = "Path where the unencrypted device will be mounted during early boot.";
|
|
||||||
};
|
|
||||||
|
|
||||||
path = mkOption {
|
|
||||||
default = "/crypt-storage/default";
|
|
||||||
type = types.str;
|
|
||||||
description = ''
|
|
||||||
Absolute path of the salt on the unencrypted device with
|
|
||||||
that device's root directory as "/".
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
|
||||||
|
|
||||||
}; };
|
device = mkOption {
|
||||||
|
example = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08";
|
||||||
|
type = types.str;
|
||||||
|
description = "Path of the underlying encrypted block device.";
|
||||||
|
};
|
||||||
|
|
||||||
|
header = mkOption {
|
||||||
|
default = null;
|
||||||
|
example = "/root/header.img";
|
||||||
|
type = types.nullOr types.str;
|
||||||
|
description = ''
|
||||||
|
The name of the file or block device that
|
||||||
|
should be used as header for the encrypted device.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
keyFile = mkOption {
|
||||||
|
default = null;
|
||||||
|
example = "/dev/sdb1";
|
||||||
|
type = types.nullOr types.str;
|
||||||
|
description = ''
|
||||||
|
The name of the file (can be a raw device or a partition) that
|
||||||
|
should be used as the decryption key for the encrypted device. If
|
||||||
|
not specified, you will be prompted for a passphrase instead.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
keyFileSize = mkOption {
|
||||||
|
default = null;
|
||||||
|
example = 4096;
|
||||||
|
type = types.nullOr types.int;
|
||||||
|
description = ''
|
||||||
|
The size of the key file. Use this if only the beginning of the
|
||||||
|
key file should be used as a key (often the case if a raw device
|
||||||
|
or partition is used as key file). If not specified, the whole
|
||||||
|
<literal>keyFile</literal> will be used decryption, instead of just
|
||||||
|
the first <literal>keyFileSize</literal> bytes.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
# FIXME: get rid of this option.
|
||||||
|
preLVM = mkOption {
|
||||||
|
default = true;
|
||||||
|
type = types.bool;
|
||||||
|
description = "Whether the luksOpen will be attempted before LVM scan or after it.";
|
||||||
|
};
|
||||||
|
|
||||||
|
allowDiscards = mkOption {
|
||||||
|
default = false;
|
||||||
|
type = types.bool;
|
||||||
|
description = ''
|
||||||
|
Whether to allow TRIM requests to the underlying device. This option
|
||||||
|
has security implications; please read the LUKS documentation before
|
||||||
|
activating it.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
yubikey = mkOption {
|
||||||
|
default = null;
|
||||||
|
description = ''
|
||||||
|
The options to use for this LUKS device in Yubikey-PBA.
|
||||||
|
If null (the default), Yubikey-PBA will be disabled for this device.
|
||||||
|
'';
|
||||||
|
|
||||||
|
type = with types; nullOr (submodule {
|
||||||
|
options = {
|
||||||
|
twoFactor = mkOption {
|
||||||
|
default = true;
|
||||||
|
type = types.bool;
|
||||||
|
description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
|
||||||
|
};
|
||||||
|
|
||||||
|
slot = mkOption {
|
||||||
|
default = 2;
|
||||||
|
type = types.int;
|
||||||
|
description = "Which slot on the Yubikey to challenge.";
|
||||||
|
};
|
||||||
|
|
||||||
|
saltLength = mkOption {
|
||||||
|
default = 16;
|
||||||
|
type = types.int;
|
||||||
|
description = "Length of the new salt in byte (64 is the effective maximum).";
|
||||||
|
};
|
||||||
|
|
||||||
|
keyLength = mkOption {
|
||||||
|
default = 64;
|
||||||
|
type = types.int;
|
||||||
|
description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
|
||||||
|
};
|
||||||
|
|
||||||
|
iterationStep = mkOption {
|
||||||
|
default = 0;
|
||||||
|
type = types.int;
|
||||||
|
description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
|
||||||
|
};
|
||||||
|
|
||||||
|
gracePeriod = mkOption {
|
||||||
|
default = 2;
|
||||||
|
type = types.int;
|
||||||
|
description = "Time in seconds to wait before attempting to find the Yubikey.";
|
||||||
|
};
|
||||||
|
|
||||||
|
ramfsMountPoint = mkOption {
|
||||||
|
default = "/crypt-ramfs";
|
||||||
|
type = types.str;
|
||||||
|
description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
|
||||||
|
};
|
||||||
|
|
||||||
|
/* TODO: Add to the documentation of the current module:
|
||||||
|
|
||||||
|
Options related to the storing the salt.
|
||||||
|
*/
|
||||||
|
storage = {
|
||||||
|
device = mkOption {
|
||||||
|
default = "/dev/sda1";
|
||||||
|
type = types.path;
|
||||||
|
description = ''
|
||||||
|
An unencrypted device that will temporarily be mounted in stage-1.
|
||||||
|
Must contain the current salt to create the challenge for this LUKS device.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
fsType = mkOption {
|
||||||
|
default = "vfat";
|
||||||
|
type = types.str;
|
||||||
|
description = "The filesystem of the unencrypted device.";
|
||||||
|
};
|
||||||
|
|
||||||
|
mountPoint = mkOption {
|
||||||
|
default = "/crypt-storage";
|
||||||
|
type = types.str;
|
||||||
|
description = "Path where the unencrypted device will be mounted during early boot.";
|
||||||
|
};
|
||||||
|
|
||||||
|
path = mkOption {
|
||||||
|
default = "/crypt-storage/default";
|
||||||
|
type = types.str;
|
||||||
|
description = ''
|
||||||
|
Absolute path of the salt on the unencrypted device with
|
||||||
|
that device's root directory as "/".
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
}; }));
|
||||||
};
|
};
|
||||||
|
|
||||||
boot.initrd.luks.yubikeySupport = mkOption {
|
boot.initrd.luks.yubikeySupport = mkOption {
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user