zfsunlock

This commit is contained in:
Motiejus Jakštys 2023-07-24 09:23:20 +03:00
parent 6c9cb09a6f
commit 679226b60f
3 changed files with 81 additions and 0 deletions

View File

@ -34,6 +34,17 @@
motiejus.passwordFile = config.age.secrets.motiejus-passwd-hash.path; motiejus.passwordFile = config.age.secrets.motiejus-passwd-hash.path;
}; };
}; };
services.zfsunlock = {
enable = true;
targets."hel1-a.servers.jakst" = {
sshEndpoint = myData.ips.hel1a;
pingEndpoint = "hel1-a.servers.jakst";
remotePubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEzt0eaSRTAfM2295x4vACEd5VFqVeYJPV/N9ZUq+voP";
pwFile = config.age.secrets.zfs-passphrase-hel1-a.path;
startAt = "*-*-* *:00/5:00";
};
};
}; };
services = { services = {

View File

@ -5,5 +5,6 @@
... ...
}: { }: {
imports = [ imports = [
./zfsunlock
]; ];
} }

View File

@ -0,0 +1,69 @@
{
config,
lib,
pkgs,
...
}: let
unlock = { sshEndpoint, pingEndpoint, remotePubkey, pwFile, pingTimeoutSec}: let
timeoutStr = builtins.toString pingTimeoutSec;
in ''
# if host is reachable via "pingEndpoint", which, we presume is
# VPN (which implies the rootfs has been unlocked for VPN to work),
# exit successfully.
${pkgs.iputils}/bin/ping -W ${timeoutStr} -c 1 ${pingEndpoint} && exit 0
exec ${pkgs.openssh}/bin/ssh \
-i /etc/ssh/ssh_host_ed25519_key \
-o UserKnownHostsFile=none \
-o GlobalKnownHostsFile=/dev/null \
-o KnownHostsCommand="${pkgs.coreutils}/bin/echo ${sshEndpoint} ${remotePubkey}" \
root@${sshEndpoint} < "${pwFile}"
'';
in {
options.mj.services.zfsunlock = with lib.types; {
enable = lib.mkEnableOption "remotely unlock zfs-encrypted root volumes";
targets = lib.mkOption {
default = {};
type = attrsOf (submodule (
{...}: {
options = {
sshEndpoint = lib.mkOption {type = str;};
pingEndpoint = lib.mkOption {type = str;};
pingTimeoutSec = lib.mkOption {type = int; default = 20;};
remotePubkey = lib.mkOption {type = str;};
pwFile = lib.mkOption {type = path;};
startAt = lib.mkOption {type = either str (listOf str);};
};
}
));
};
};
config = lib.mkIf config.mj.services.zfsunlock.enable {
systemd.services = lib.mapAttrs'
(name: cfg:
lib.nameValuePair "zfsunlock-${name}" {
description = "zfsunlock service for ${name}";
script = unlock (builtins.removeAttrs cfg ["startAt"]);
serviceConfig = {
User = "root";
ProtectSystem = "strict";
};
}
) config.mj.services.zfsunlock.targets;
systemd.timers = lib.mapAttrs'
(name: cfg:
lib.nameValuePair "zfsunlock-${name}" {
description = "zfsunlock timer for ${name}";
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = cfg.startAt;
};
after = [ "network-online.target" ];
}
) config.mj.services.zfsunlock.targets;
};
}