JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #319359 from misuzu/clevis-zfs-fix

Browse Source 
nixos/clevis: add support for parent encrypted zfs datasets
This commit is contained in:
Will Fancher 2024-06-24 14:47:55 -04:00 committed by GitHub
commit 2893f56de0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/system/boot/clevis.nix
View File

@ -48,7 +48,7 @@ in
assertions = (attrValues (mapAttrs
(device: _: {
assertion = (any (fs: fs.device == device && (elem fs.fsType supportedFs)) config.system.build.fileSystems) || (hasAttr device config.boot.initrd.luks.devices);
assertion = (any (fs: fs.device == device && (elem fs.fsType supportedFs) || (fs.fsType == "zfs" && hasPrefix "${device}/" fs.device)) config.system.build.fileSystems) || (hasAttr device config.boot.initrd.luks.devices);
message = ''
No filesystem or LUKS device with the name ${device} is declared in your configuration.'';
})

3
nixos/modules/tasks/filesystems/zfs.nix
View File

@ -17,8 +17,7 @@ let
cfgZED = config.services.zfs.zed;
selectModulePackage = package: config.boot.kernelPackages.${package.kernelModuleAttribute};
clevisDatasets = map (e: e.device) (filter (e: e.device != null && (hasAttr e.device config.boot.initrd.clevis.devices) && e.fsType == "zfs" && (fsNeededForBoot e)) config.system.build.fileSystems);
clevisDatasets = attrNames (filterAttrs (device: _: any (e: e.fsType == "zfs" && (fsNeededForBoot e) && (e.device == device || hasPrefix "${device}/" e.device)) config.system.build.fileSystems) config.boot.initrd.clevis.devices);
inInitrd = config.boot.initrd.supportedFilesystems.zfs or false;
inSystem = config.boot.supportedFilesystems.zfs or false;

2
nixos/tests/installer-systemd-stage-1.nix
View File

@ -37,6 +37,8 @@
clevisLuksFallback
clevisZfs
clevisZfsFallback
clevisZfsParentDataset
clevisZfsParentDatasetFallback
gptAutoRoot
clevisBcachefs
clevisBcachefsFallback

16
nixos/tests/installer.nix
View File

@ -714,7 +714,7 @@ let
'';
};
mkClevisZfsTest = { fallback ? false }: makeInstallerTest "clevis-zfs${optionalString fallback "-fallback"}" {
mkClevisZfsTest = { fallback ? false, parentDataset ? false }: makeInstallerTest "clevis-zfs${optionalString parentDataset "-parent-dataset"}${optionalString fallback "-fallback"}" {
clevisTest = true;
clevisFallbackTest = fallback;
enableOCR = fallback;
@ -731,17 +731,27 @@ let
"udevadm settle",
"mkswap /dev/vda2 -L swap",
"swapon -L swap",
'' + optionalString (!parentDataset) ''
"zpool create -O mountpoint=legacy rpool /dev/vda3",
"echo -n password | zfs create"
+ " -o encryption=aes-256-gcm -o keyformat=passphrase rpool/root",
'' + optionalString (parentDataset) ''
"echo -n password | zpool create -O mountpoint=none -O encryption=on -O keyformat=passphrase rpool /dev/vda3",
"zfs create -o mountpoint=legacy rpool/root",
'' +
''
"mount -t zfs rpool/root /mnt",
"mkfs.ext3 -L boot /dev/vda1",
"mkdir -p /mnt/boot",
"mount LABEL=boot /mnt/boot",
"udevadm settle")
'';
extraConfig = ''
extraConfig = optionalString (!parentDataset) ''
boot.initrd.clevis.devices."rpool/root".secretFile = "/etc/nixos/clevis-secret.jwe";
'' + optionalString (parentDataset) ''
boot.initrd.clevis.devices."rpool".secretFile = "/etc/nixos/clevis-secret.jwe";
'' +
''
boot.zfs.requestEncryptionCredentials = true;
@ -1359,6 +1369,8 @@ in {
clevisLuksFallback = mkClevisLuksTest { fallback = true; };
clevisZfs = mkClevisZfsTest { };
clevisZfsFallback = mkClevisZfsTest { fallback = true; };
clevisZfsParentDataset = mkClevisZfsTest { parentDataset = true; };
clevisZfsParentDatasetFallback = mkClevisZfsTest { parentDataset = true; fallback = true; };
} // optionalAttrs systemdStage1 {
stratisRoot = makeInstallerTest "stratisRoot" {
createPartitions = ''