646b892680
Some checks failed
Periodic Merges (6h) / master → staging-nixos (push) Failing after 12m50s
Periodic Merges (6h) / master → staging-next (push) Failing after 12m54s
Periodic Merges (24h) / merge-base(master,staging) → haskell-updates (push) Failing after 11m54s
Periodic Merges (6h) / staging-next → staging (push) Failing after 12m13s
Periodic Merges (24h) / staging-next-25.05 → staging-25.05 (push) Failing after 13m24s
Periodic Merges (24h) / release-25.05 → staging-next-25.05 (push) Failing after 14m28s
52 lines
1.7 KiB
Nix
52 lines
1.7 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
{
|
|
config = lib.mkIf (config.boot.initrd.enable && config.boot.initrd.systemd.enable) {
|
|
# Copy secrets into the initrd if they cannot be appended
|
|
boot.initrd.systemd.contents = lib.mkIf (!config.boot.loader.supportsInitrdSecrets) (
|
|
lib.mapAttrs' (
|
|
dest: source:
|
|
lib.nameValuePair "/.initrd-secrets/${dest}" { source = if source == null then dest else source; }
|
|
) config.boot.initrd.secrets
|
|
);
|
|
|
|
# Copy secrets to their respective locations
|
|
boot.initrd.systemd.services.initrd-nixos-copy-secrets =
|
|
lib.mkIf (config.boot.initrd.secrets != { })
|
|
{
|
|
description = "Copy secrets into place";
|
|
# Run as early as possible
|
|
wantedBy = [ "sysinit.target" ];
|
|
before = [
|
|
"cryptsetup-pre.target"
|
|
"shutdown.target"
|
|
];
|
|
conflicts = [ "shutdown.target" ];
|
|
unitConfig.DefaultDependencies = false;
|
|
|
|
# We write the secrets to /.initrd-secrets and move them because this allows
|
|
# secrets to be written to /run. If we put the secret directly to /run and
|
|
# drop this service, we'd mount the /run tmpfs over the secret, making it
|
|
# invisible in stage 2.
|
|
script = ''
|
|
for secret in $(cd /.initrd-secrets; find . -type f -o -type l); do
|
|
mkdir -p "$(dirname "/$secret")"
|
|
cp "/.initrd-secrets/$secret" "/$secret"
|
|
done
|
|
'';
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
};
|
|
# The script needs this
|
|
boot.initrd.systemd.extraBin.find = "${pkgs.findutils}/bin/find";
|
|
};
|
|
}
|