public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request from kini/nixos/boot/documentation-improvements

Browse Source 
nixos/boot: some documentation improvements
This commit is contained in:
worldofpeace 2020-07-29 20:20:59 -04:00 committed by GitHub
commit b69c61eb39
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 26 additions and 11 deletions
nixos
lib
utils.nix
modules
system/boot
stage-1.nix
tasks
encrypted-devices.nix

8
nixos/lib/utils.nix
View File

@ -2,9 +2,11 @@ pkgs: with pkgs.lib;
rec { rec {
# Check whenever fileSystem is needed for boot # Check whenever fileSystem is needed for boot. NOTE: Make sure
fsNeededForBoot = fs: fs.neededForBoot # pathsNeededForBoot is closed under the parent relationship, i.e. if /a/b/c
|| elem fs.mountPoint [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/etc" ]; # is in the list, put /a and /a/b in as well.
pathsNeededForBoot = [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/etc" ];
fsNeededForBoot = fs: fs.neededForBoot || elem fs.mountPoint pathsNeededForBoot;
# Check whenever `b` depends on `a` as a fileSystem # Check whenever `b` depends on `a` as a fileSystem
fsBefore = a: b: a.mountPoint == b.device fsBefore = a: b: a.mountPoint == b.device

10
nixos/modules/system/boot/stage-1.nix
View File

@ -559,10 +559,12 @@ in
default = false; default = false;
type = types.bool; type = types.bool;
description = '' description = ''
If set, this file system will be mounted in the initial If set, this file system will be mounted in the initial ramdisk.
ramdisk. By default, this applies to the root file system Note that the file system will always be mounted in the initial
and to the file system containing ramdisk if its mount point is one of the following:
<filename>/nix/store</filename>. ${concatStringsSep ", " (
forEach utils.pathsNeededForBoot (i: "<filename>${i}</filename>")
)}.
''; '';
}; };
}); });

19
nixos/modules/tasks/encrypted-devices.nix
View File

@ -37,7 +37,14 @@ let
default = null; default = null;
example = "/mnt-root/root/.swapkey"; example = "/mnt-root/root/.swapkey";
type = types.nullOr types.str; type = types.nullOr types.str;
description = "File system location of keyfile. This unlocks the drive after the root has been mounted to <literal>/mnt-root</literal>."; description = ''
Path to a keyfile used to unlock the backing encrypted
device. At the time this keyfile is accessed, the
<literal>neededForBoot</literal> filesystems (see
<literal>fileSystems.&lt;name?&gt;.neededForBoot</literal>)
will have been mounted under <literal>/mnt-root</literal>,
so the keyfile path should usually start with "/mnt-root/".
'';
}; };
}; };
}; };
@ -65,12 +72,16 @@ in
boot.initrd = { boot.initrd = {
luks = { luks = {
devices = devices =
builtins.listToAttrs (map (dev: { name = dev.encrypted.label; value = { device = dev.encrypted.blkDev; }; }) keylessEncDevs); builtins.listToAttrs (map (dev: {
name = dev.encrypted.label;
value = { device = dev.encrypted.blkDev; };
}) keylessEncDevs);
forceLuksSupportInInitrd = true; forceLuksSupportInInitrd = true;
}; };
postMountCommands = postMountCommands =
concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n") keyedEncDevs; concatMapStrings (dev:
"cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n"
) keyedEncDevs;
}; };
}; };
} }