config/modules/services/zfsunlock/default.nix

84 lines
2.3 KiB
Nix
Raw Normal View History

2023-07-24 09:23:20 +03:00
{
config,
lib,
pkgs,
...
}: let
2023-08-09 14:24:22 +03:00
mkUnlock = {
2023-07-24 12:31:06 +03:00
sshEndpoint,
pingEndpoint,
remotePubkey,
pwFile,
pingTimeoutSec,
}: let
2023-07-24 09:23:20 +03:00
timeoutStr = builtins.toString pingTimeoutSec;
in ''
# if host is reachable via "pingEndpoint", which, we presume is
# VPN (which implies the rootfs has been unlocked for VPN to work),
# exit successfully.
2023-07-24 10:38:29 +03:00
${pkgs.iputils}/bin/ping -q -W ${timeoutStr} -c 1 ${pingEndpoint} && exit 0
2023-07-24 09:23:20 +03:00
exec ${pkgs.openssh}/bin/ssh \
-i /etc/ssh/ssh_host_ed25519_key \
-o UserKnownHostsFile=none \
-o GlobalKnownHostsFile=/dev/null \
-o KnownHostsCommand="${pkgs.coreutils}/bin/echo ${sshEndpoint} ${remotePubkey}" \
root@${sshEndpoint} < "${pwFile}"
'';
in {
options.mj.services.zfsunlock = with lib.types; {
enable = lib.mkEnableOption "remotely unlock zfs-encrypted root volumes";
targets = lib.mkOption {
default = {};
type = attrsOf (submodule (
{...}: {
options = {
sshEndpoint = lib.mkOption {type = str;};
pingEndpoint = lib.mkOption {type = str;};
2023-07-24 12:31:06 +03:00
pingTimeoutSec = lib.mkOption {
type = int;
default = 20;
};
2023-07-24 09:23:20 +03:00
remotePubkey = lib.mkOption {type = str;};
pwFile = lib.mkOption {type = path;};
startAt = lib.mkOption {type = either str (listOf str);};
};
}
));
};
};
config = lib.mkIf config.mj.services.zfsunlock.enable {
2023-07-24 12:31:06 +03:00
systemd.services =
lib.mapAttrs'
(
name: cfg:
lib.nameValuePair "zfsunlock-${name}" {
description = "zfsunlock service for ${name}";
2023-08-09 14:24:22 +03:00
script = mkUnlock (builtins.removeAttrs cfg ["startAt"]);
2023-07-24 12:31:06 +03:00
serviceConfig = {
User = "root";
ProtectSystem = "strict";
};
}
)
config.mj.services.zfsunlock.targets;
2023-07-24 09:23:20 +03:00
2023-07-24 12:31:06 +03:00
systemd.timers =
lib.mapAttrs'
(
name: cfg:
lib.nameValuePair "zfsunlock-${name}" {
description = "zfsunlock timer for ${name}";
wantedBy = ["timers.target"];
timerConfig = {
OnCalendar = cfg.startAt;
};
after = ["network-online.target"];
}
)
config.mj.services.zfsunlock.targets;
2023-07-24 09:23:20 +03:00
};
}