LUKS-Encrypted File SystemsNixOS supports file systems that are encrypted using
LUKS (Linux Unified Key Setup). For example,
here is how you create an encrypted Ext4 file system on the device
/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d:
# cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d
WARNING!
========
This will overwrite data on /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d irrevocably.
Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase: ***
Verify passphrase: ***
# cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted
Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
# mkfs.ext4 /dev/mapper/crypted
To ensure that this file system is automatically mounted at boot time
as /, add the following to
configuration.nix:
boot.initrd.luks.devices.crypted.device = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
."/".device = "/dev/mapper/crypted";
Should grub be used as bootloader, and /boot is located
on an encrypted partition, it is necessary to add the following grub option:
= true;