trying to get usb unlock working backtracking
This commit is contained in:
RingOfStorms (Joshua Bell)
parent
e9b56dc48c
commit
8882eaa3ab
2 changed files with 186 additions and 125 deletions
|
|
@ -1,6 +1,8 @@
|
||||||
{
|
{
|
||||||
|
config,
|
||||||
utils,
|
utils,
|
||||||
pkgs,
|
pkgs,
|
||||||
|
lib,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
let
|
let
|
||||||
|
|
@ -14,93 +16,124 @@ let
|
||||||
|
|
||||||
primaryDeviceUnit = "${escapeSystemdPath PRIMARY}.device";
|
primaryDeviceUnit = "${escapeSystemdPath PRIMARY}.device";
|
||||||
in
|
in
|
||||||
{
|
lib.mkMerge [
|
||||||
# BOOT
|
# Main filesystems
|
||||||
fileSystems."/boot" = {
|
{
|
||||||
device = BOOT;
|
# BOOT
|
||||||
fsType = "vfat";
|
fileSystems."/boot" = {
|
||||||
options = [
|
device = BOOT;
|
||||||
"fmask=0022"
|
fsType = "vfat";
|
||||||
"dmask=0022"
|
options = [
|
||||||
];
|
"fmask=0022"
|
||||||
};
|
"dmask=0022"
|
||||||
|
];
|
||||||
# PRIMARY
|
};
|
||||||
fileSystems."/" = {
|
|
||||||
device = PRIMARY;
|
|
||||||
fsType = "bcachefs";
|
|
||||||
options = [
|
|
||||||
"X-mount.subdir=@root"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
fileSystems."/.old_roots" = {
|
|
||||||
device = PRIMARY;
|
|
||||||
fsType = "bcachefs";
|
|
||||||
options = [
|
|
||||||
"nofail" # this may not exist yet just skip it
|
|
||||||
"X-mount.mkdir"
|
|
||||||
"X-mount.subdir=@old_roots"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
fileSystems."/nix" = {
|
|
||||||
device = PRIMARY;
|
|
||||||
fsType = "bcachefs";
|
|
||||||
options = [
|
|
||||||
"X-mount.mkdir"
|
|
||||||
"X-mount.subdir=@nix"
|
|
||||||
"relatime"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
fileSystems."/.snapshots" = {
|
|
||||||
device = PRIMARY;
|
|
||||||
fsType = "bcachefs";
|
|
||||||
options = [
|
|
||||||
"X-mount.mkdir"
|
|
||||||
"X-mount.subdir=@root"
|
|
||||||
"relatime"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
# (optional) for preservation/impermanence
|
|
||||||
fileSystems."/persist" = {
|
|
||||||
device = PRIMARY;
|
|
||||||
fsType = "bcachefs";
|
|
||||||
options = [
|
|
||||||
"X-mount.mkdir"
|
|
||||||
"X-mount.subdir=@persist"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
|
# PRIMARY
|
||||||
|
fileSystems."/" = {
|
||||||
|
device = PRIMARY;
|
||||||
|
fsType = "bcachefs";
|
||||||
|
options = [
|
||||||
|
"X-mount.subdir=@root"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
fileSystems."/.old_roots" = {
|
||||||
|
device = PRIMARY;
|
||||||
|
fsType = "bcachefs";
|
||||||
|
options = [
|
||||||
|
"nofail" # this may not exist yet just skip it
|
||||||
|
"X-mount.mkdir"
|
||||||
|
"X-mount.subdir=@old_roots"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
fileSystems."/nix" = {
|
||||||
|
device = PRIMARY;
|
||||||
|
fsType = "bcachefs";
|
||||||
|
options = [
|
||||||
|
"X-mount.mkdir"
|
||||||
|
"X-mount.subdir=@nix"
|
||||||
|
"relatime"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
fileSystems."/.snapshots" = {
|
||||||
|
device = PRIMARY;
|
||||||
|
fsType = "bcachefs";
|
||||||
|
options = [
|
||||||
|
"X-mount.mkdir"
|
||||||
|
"X-mount.subdir=@root"
|
||||||
|
"relatime"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
# (optional) for preservation/impermanence
|
||||||
|
fileSystems."/persist" = {
|
||||||
|
device = PRIMARY;
|
||||||
|
fsType = "bcachefs";
|
||||||
|
options = [
|
||||||
|
"X-mount.mkdir"
|
||||||
|
"X-mount.subdir=@persist"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
# SWAP
|
# SWAP
|
||||||
swapDevices = [
|
{
|
||||||
# {
|
swapDevices = [
|
||||||
# device = "/.swap/swapfile";
|
# {
|
||||||
# size = 8 * 1024; # Creates an 8GB swap file
|
# device = "/.swap/swapfile";
|
||||||
# }
|
# size = 8 * 1024; # Creates an 8GB swap file
|
||||||
];
|
# }
|
||||||
|
];
|
||||||
|
}
|
||||||
|
# Disable bcachefs built in password prompts for all mounts (which asks for every single subdir mount above
|
||||||
|
{
|
||||||
|
boot.initrd.systemd.enable = true;
|
||||||
|
|
||||||
# PRIMARY Bcache utilities
|
# https://github.com/NixOS/nixpkgs/blob/6cdf2f456a57164282ede1c97fc5532d9dba1ee0/nixos/modules/tasks/filesystems/bcachefs.nix#L254-L259
|
||||||
boot.initrd.systemd.enable = true;
|
systemd.services =
|
||||||
boot.supportedFilesystems = [
|
# let
|
||||||
"bcachefs"
|
# isSystemdNonBootBcache = v: (v.fsType == "bcachefs") && (!utils.fsNeededForBoot v);
|
||||||
"vfat"
|
# bcacheNonBoots = lib.filterAttrs (k: v: isSystemdNonBootBcache v) config.fileSystems;
|
||||||
];
|
# in
|
||||||
|
# (lib.mapAttrs (k: v: { enable = false; }) bcacheNonBoots);
|
||||||
|
{
|
||||||
|
# NOTE that neededForBoot fs's dont end up in this list
|
||||||
|
"unlock-bcachefs-${escapeSystemdPath "/.old_roots"}".enable = false;
|
||||||
|
"unlock-bcachefs-${escapeSystemdPath "/.snapshots"}".enable = false;
|
||||||
|
"unlock-bcachefs-${escapeSystemdPath "/.swap"}".enable = false;
|
||||||
|
"unlock-bcachefs-${escapeSystemdPath "/persist"}".enable = false;
|
||||||
|
};
|
||||||
|
|
||||||
systemd.services = {
|
# https://github.com/NixOS/nixpkgs/blob/6cdf2f456a57164282ede1c97fc5532d9dba1ee0/nixos/modules/tasks/filesystems/bcachefs.nix#L291
|
||||||
# NOTE that neededForBoot fs's dont end up in this list
|
boot.initrd.systemd.services =
|
||||||
"unlock-bcachefs-${escapeSystemdPath "/.old_roots"}".enable = false;
|
# let
|
||||||
"unlock-bcachefs-${escapeSystemdPath "/.snapshots"}".enable = false;
|
# isSystemdBootBcache = v: (v.fsType == "bcachefs") && (utils.fsNeededForBoot v);
|
||||||
"unlock-bcachefs-${escapeSystemdPath "/.swap"}".enable = false;
|
# bcacheBoots = lib.filterAttrs (k: v: isSystemdBootBcache v) config.fileSystems;
|
||||||
"unlock-bcachefs-${escapeSystemdPath "/persist"}".enable = false;
|
# in
|
||||||
};
|
# (lib.mapAttrs (k: v: { enable = false; }) bcacheBoots);
|
||||||
|
{
|
||||||
|
"unlock-bcachefs-${escapeSystemdPath "/sysroot"}".enable = false;
|
||||||
|
"unlock-bcachefs-${escapeSystemdPath "/"}".enable = false;
|
||||||
|
"unlock-bcachefs-${escapeSystemdPath "/nix"}".enable = false;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
# Bcachefs auto decryption
|
||||||
|
{
|
||||||
|
boot.supportedFilesystems = [
|
||||||
|
"bcachefs"
|
||||||
|
];
|
||||||
|
|
||||||
# 1. Disable the automatically generated unlock services
|
# boot.initrd.systemd.mounts = [
|
||||||
boot.initrd.systemd.services = {
|
# {
|
||||||
"unlock-bcachefs-${escapeSystemdPath "/sysroot"}".enable = false; # special always on one
|
# what = USB_KEY;
|
||||||
"unlock-bcachefs-${escapeSystemdPath "/"}".enable = false;
|
# type = "bcachefs";
|
||||||
"unlock-bcachefs-${escapeSystemdPath "/nix"}".enable = false;
|
# where = "/usb_key";
|
||||||
|
# options = "ro";
|
||||||
# 2. Your single custom unlock unit
|
# description = "key";
|
||||||
unlock-bcachefs-custom = {
|
# wantedBy = [
|
||||||
|
# "initrd.target"
|
||||||
|
# ];
|
||||||
|
# }
|
||||||
|
# ];
|
||||||
|
boot.initrd.systemd.services.unlock-bcachefs-custom = {
|
||||||
description = "Custom single bcachefs unlock for all subvolumes";
|
description = "Custom single bcachefs unlock for all subvolumes";
|
||||||
|
|
||||||
wantedBy = [ "initrd.target" ];
|
wantedBy = [ "initrd.target" ];
|
||||||
|
|
@ -108,50 +141,79 @@ in
|
||||||
|
|
||||||
requires = [ primaryDeviceUnit ];
|
requires = [ primaryDeviceUnit ];
|
||||||
after = [ primaryDeviceUnit ];
|
after = [ primaryDeviceUnit ];
|
||||||
|
|
||||||
# NOTE: put the real password here, or better: read it from USB_KEY
|
|
||||||
# ExecStart = ''
|
|
||||||
# /bin/sh -c 'echo "password" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock ${PRIMARY}'
|
|
||||||
# '';
|
|
||||||
# ExecStart = ''
|
|
||||||
# /bin/sh -c 'mount --mkdir -o ro ${USB_KEY} /key && \
|
|
||||||
# cat /key/bcachefs.key | ${pkgs.bcachefs-tools}/bin/bcachefs unlock ${PRIMARY}'
|
|
||||||
# '';
|
|
||||||
|
|
||||||
# We inline a script that roughly mimics tryUnlock + openCommand behavior,
|
|
||||||
# but uses a key file from the USB stick instead of systemd-ask-password.
|
|
||||||
script = ''
|
script = ''
|
||||||
echo "Using USB key for bcachefs unlock: ${USB_KEY}"
|
echo "Using test password..."
|
||||||
mount -t bcachefs --mkdir "${USB_KEY}" /usb_key
|
echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
|
||||||
${pkgs.bcachefs-tools}/bin/bcachefs unlock -f /usb_key/key "${PRIMARY}"
|
|
||||||
echo "bcachefs unlock successful for ${PRIMARY}"
|
echo "bcachefs unlock successful for ${PRIMARY}"
|
||||||
'';
|
'';
|
||||||
# Hard code password (useless in real env)
|
# script = ''
|
||||||
# echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
|
# echo "Using USB key for bcachefs unlock: ${USB_KEY}"
|
||||||
|
#
|
||||||
|
# echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
|
||||||
|
# echo "done...."
|
||||||
|
# exit 0
|
||||||
|
#
|
||||||
|
# # only try mount if the node exists
|
||||||
|
# if [ ! -e "${USB_KEY}" ]; then
|
||||||
|
# echo "USB key device ${USB_KEY} not present in initrd"
|
||||||
|
# exit 1
|
||||||
|
# fi
|
||||||
|
# ${pkgs.bcachefs-tools}/bin/bcachefs unlock -f /usb_key/key "${PRIMARY}"
|
||||||
|
# echo "bcachefs unlock successful for ${PRIMARY}"
|
||||||
|
# '';
|
||||||
};
|
};
|
||||||
};
|
|
||||||
|
|
||||||
# TODO this works for resetting root!
|
# TODO rotate root
|
||||||
# boot.initrd.postResumeCommands = lib.mkAfter ''
|
}
|
||||||
# echo "test" | bcachefs unlock ${PRIMARY}
|
# Reset root for erase your darlings/impermanence/preservation
|
||||||
#
|
{
|
||||||
# mkdir /primary_tmp
|
# boot.initrd.systemd.services.bcachefs-reset-root = {
|
||||||
# mount ${PRIMARY} primary_tmp/
|
# description = "Reset bcachefs root subvolume before pivot";
|
||||||
# if [[ -e /primary_tmp/@root ]]; then
|
# wantedBy = [ "initrd.target" ];
|
||||||
# mkdir -p /primary_tmp/@old_roots
|
#
|
||||||
# bcachefs set-file-option /primary_tmp/@old_roots --compression=zstd
|
# after = [
|
||||||
#
|
# "initrd-root-device.target"
|
||||||
# timestamp=$(date --date="@$(stat -c %Y /primary_tmp/@root)" "+%Y-%m-%-d_%H:%M:%S")
|
# "cryptsetup.target"
|
||||||
# bcachefs subvolume snapshot /primary_tmp/@root "/primary_tmp/@old_roots/$timestamp"
|
# "unlock-bcachefs-custom"
|
||||||
# bcachefs subvolume delete /primary_tmp/@root
|
# ];
|
||||||
# fi
|
# requires = [ primaryDeviceUnit ];
|
||||||
#
|
#
|
||||||
# for i in $(find /primary_tmp/old_roots/ -maxdepth 1 -mtime +30); do
|
# serviceConfig = {
|
||||||
# bcachefs subvolume delete "$i"
|
# Type = "oneshot";
|
||||||
# done
|
# # initrd has a minimal PATH; set one explicitly
|
||||||
#
|
# Environment = "PATH=/bin:/sbin:/usr/bin:/usr/sbin";
|
||||||
# bcachefs subvolume create /primary_tmp/@root
|
# # If tools are in /usr, this helps ensure it's in the initrd
|
||||||
# umount /primary_tmp
|
# # (you may also need environment.systemPackages + boot.initrd.includeDefaultModules)
|
||||||
# '';
|
# ExecStart = pkgs.writeShellScript "bcachefs-reset-root" ''
|
||||||
}
|
# set -euo pipefail
|
||||||
|
#
|
||||||
|
# PRIMARY=${PRIMARY}
|
||||||
|
#
|
||||||
|
# echo "Unlocking bcachefs volume ${PRIMARY}..."
|
||||||
|
# echo "test" | bcachefs unlock "''${PRIMARY}"
|
||||||
|
#
|
||||||
|
# mkdir -p /primary_tmp
|
||||||
|
# mount "''${PRIMARY}" /primary_tmp
|
||||||
|
#
|
||||||
|
# if [[ -e /primary_tmp/@root ]]; then
|
||||||
|
# mkdir -p /primary_tmp/@old_roots
|
||||||
|
# bcachefs set-file-option /primary_tmp/@old_roots --compression=zstd
|
||||||
|
#
|
||||||
|
# timestamp=$(date --date="@$(stat -c %Y /primary_tmp/@root)" "+%Y-%m-%-d_%H:%M:%S")
|
||||||
|
# bcachefs subvolume snapshot /primary_tmp/@root "/primary_tmp/@old_roots/$timestamp"
|
||||||
|
# bcachefs subvolume delete /primary_tmp/@root
|
||||||
|
#
|
||||||
|
# # Cleanup old snapshots (>30 days)
|
||||||
|
# # Note: path was /primary_tmp/old_roots in your snippet; using @old_roots for consistency
|
||||||
|
# for i in $(find /primary_tmp/@old_roots/ -maxdepth 1 -mtime +30); do
|
||||||
|
# bcachefs subvolume delete "$i"
|
||||||
|
# done
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
# bcachefs subvolume create /primary_tmp/@root
|
||||||
|
# umount /primary_tmp
|
||||||
|
# '';
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
}
|
||||||
|
]
|
||||||
|
|
|
||||||
|
|
@ -99,7 +99,6 @@ or from host machine? TODO haven't tried this fully
|
||||||
|
|
||||||
```sh
|
```sh
|
||||||
NIX_SSHOPTS="-i /run/agenix/nix2nix" sudo nixos-rebuild switch --flake "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=hosts/i001#i001" --target-host luser@10.12.14.157 --build-host localhost
|
NIX_SSHOPTS="-i /run/agenix/nix2nix" sudo nixos-rebuild switch --flake "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=hosts/i001#i001" --target-host luser@10.12.14.157 --build-host localhost
|
||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## USB Key
|
## USB Key
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue