Encrypted root support via LUKS

svn path=/nixos/trunk/; revision=24459

modules/module-list.nix

@@ -146,6 +146,7 @@
   ./system/activation/activation-script.nix
   ./system/activation/top-level.nix
   ./system/boot/kernel.nix
+  ./system/boot/luksroot.nix
   ./system/boot/modprobe.nix
   ./system/boot/stage-1.nix
   ./system/boot/stage-2.nix

modules/system/boot/luksroot.nix

@@ -0,0 +1,45 @@
+{pkgs, config, ...}:
+
+with pkgs.lib;
+
+let
+  luksRoot = config.boot.initrd.luksRoot;
+in
+{
+
+  options = {
+
+    boot.initrd.luksRoot = mkOption {
+      default = null;
+      example = "/dev/sda3";
+      description = '';
+        The device that should be decrypted using LUKS before trying to mount the
+        root partition. This works for both LVM-over-LUKS and LUKS-over-LVM setups.
+         
+        Make sure that initrd has the crypto modules needed for decryption.
+
+        The decrypted device name is /dev/mapper/luksroot.
+      '';
+    };
+
+  };
+
+
+
+  config = mkIf (luksRoot != null) {
+
+    boot.initrd.extraUtilsCommands = ''
+      cp -r ${pkgs.cryptsetup}/lib/* $out/lib/
+      cp -r ${pkgs.popt}/lib/* $out/lib
+      cp ${pkgs.cryptsetup}/sbin/* $out/bin
+    '';
+
+    boot.initrd.postDeviceCommands = ''
+      cryptsetup luksOpen ${luksRoot} luksroot
+      lvm vgscan
+      lvm vgchange -ay
+    '';
+
+  };
+
+}