movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 14:10:33 +03:00
Code Activity

Merge pull request #210812 from rnhmjoj/pr-initrd-secrets

Browse source 
boot.initrd.secrets fixes
This commit is contained in:
Michele Guerini Rocco 2023-01-17 00:48:58 +01:00 • committed by GitHub
commit 594b94b4c3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 73 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

54
nixos/tests/installer.nix
View file

@ -51,7 +51,7 @@ let
boot.loader.systemd-boot.enable = true;
''}
boot.initrd.secrets."/etc/secret" = /etc/nixos/secret;
boot.initrd.secrets."/etc/secret" = ./secret;
users.users.alice = {
isNormalUser = true;
@ -150,8 +150,7 @@ let
)
with subtest("Shutdown system after installation"):
machine.succeed("umount /mnt/boot || true")
machine.succeed("umount /mnt")
machine.succeed("umount -R /mnt")
machine.succeed("sync")
machine.shutdown()
@ -672,6 +671,55 @@ in {
'';
};
# Full disk encryption (root, kernel and initrd encrypted) using GRUB, GPT/UEFI,
# LVM-on-LUKS and a keyfile in initrd.secrets to enter the passphrase once
fullDiskEncryption = makeInstallerTest "fullDiskEncryption" {
createPartitions = ''
machine.succeed(
"flock /dev/vda parted --script /dev/vda -- mklabel gpt"
+ " mkpart ESP fat32 1M 100MiB" # /boot/efi
+ " set 1 boot on"
+ " mkpart primary ext2 1024MiB -1MiB", # LUKS
"udevadm settle",
"modprobe dm_mod dm_crypt",
"dd if=/dev/random of=luks.key bs=256 count=1",
"echo -n supersecret | cryptsetup luksFormat -q --pbkdf-force-iterations 1000 --type luks1 /dev/vda2 -",
"echo -n supersecret | cryptsetup luksAddKey -q --pbkdf-force-iterations 1000 --key-file - /dev/vda2 luks.key",
"echo -n supersecret | cryptsetup luksOpen --key-file - /dev/vda2 crypt",
"pvcreate /dev/mapper/crypt",
"vgcreate crypt /dev/mapper/crypt",
"lvcreate -L 100M -n swap crypt",
"lvcreate -l '100%FREE' -n nixos crypt",
"mkfs.vfat -n efi /dev/vda1",
"mkfs.ext4 -L nixos /dev/crypt/nixos",
"mkswap -L swap /dev/crypt/swap",
"mount LABEL=nixos /mnt",
"mkdir -p /mnt/{etc/nixos,boot/efi}",
"mount LABEL=efi /mnt/boot/efi",
"swapon -L swap",
"mv luks.key /mnt/etc/nixos/"
)
'';
bootLoader = "grub";
grubUseEfi = true;
extraConfig = ''
boot.loader.grub.enableCryptodisk = true;
boot.loader.efi.efiSysMountPoint = "/boot/efi";
boot.initrd.secrets."/luks.key" = ./luks.key;
boot.initrd.luks.devices.crypt =
{ device = "/dev/vda2";
keyFile = "/luks.key";
};
'';
enableOCR = true;
preBootCommands = ''
machine.start()
machine.wait_for_text("Enter passphrase for")
machine.send_chars("supersecret\n")
'';
};
swraid = makeInstallerTest "swraid" {
createPartitions = ''
machine.succeed(