87 lines
2.4 KiB
Nix
87 lines
2.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
mkUnlock = {
|
|
sshEndpoint,
|
|
pingEndpoint,
|
|
remotePubkey,
|
|
pwFile,
|
|
pingTimeoutSec,
|
|
}: let
|
|
timeoutStr = builtins.toString pingTimeoutSec;
|
|
in ''
|
|
set -x
|
|
# if host is reachable via "pingEndpoint", which, we presume is
|
|
# VPN (which implies the rootfs has been unlocked for VPN to work),
|
|
# exit successfully.
|
|
${pkgs.iputils}/bin/ping -q -W ${timeoutStr} -c 1 ${pingEndpoint} && exit 0
|
|
|
|
exec ${pkgs.openssh}/bin/ssh \
|
|
-i /etc/ssh/ssh_host_ed25519_key \
|
|
-o UserKnownHostsFile=none \
|
|
-o GlobalKnownHostsFile=/dev/null \
|
|
-o KnownHostsCommand="${pkgs.coreutils}/bin/echo ${sshEndpoint} ${remotePubkey}" \
|
|
root@${sshEndpoint} < "${pwFile}"
|
|
'';
|
|
in {
|
|
options.mj.services.zfsunlock = with lib.types; {
|
|
enable = lib.mkEnableOption "remotely unlock zfs-encrypted root volumes";
|
|
|
|
targets = lib.mkOption {
|
|
default = {};
|
|
type = attrsOf (submodule {
|
|
options = {
|
|
sshEndpoint = lib.mkOption {type = str;};
|
|
pingEndpoint = lib.mkOption {type = str;};
|
|
pingTimeoutSec = lib.mkOption {
|
|
type = int;
|
|
default = 20;
|
|
};
|
|
remotePubkey = lib.mkOption {type = str;};
|
|
pwFile = lib.mkOption {type = path;};
|
|
startAt = lib.mkOption {type = either str (listOf str);};
|
|
};
|
|
});
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf config.mj.services.zfsunlock.enable {
|
|
systemd.services =
|
|
lib.mapAttrs'
|
|
(
|
|
name: cfg:
|
|
lib.nameValuePair "zfsunlock-${name}" {
|
|
description = "zfsunlock service for ${name}";
|
|
script = mkUnlock (builtins.removeAttrs cfg ["startAt"]);
|
|
serviceConfig = {
|
|
User = "root";
|
|
ProtectSystem = "strict";
|
|
};
|
|
}
|
|
)
|
|
config.mj.services.zfsunlock.targets;
|
|
|
|
systemd.timers =
|
|
lib.mapAttrs'
|
|
(
|
|
name: cfg:
|
|
lib.nameValuePair "zfsunlock-${name}" {
|
|
description = "zfsunlock timer for ${name}";
|
|
wantedBy = ["timers.target"];
|
|
timerConfig = {
|
|
OnCalendar = cfg.startAt;
|
|
};
|
|
after = ["network-online.target"];
|
|
}
|
|
)
|
|
config.mj.services.zfsunlock.targets;
|
|
|
|
mj.base.unitstatus.units =
|
|
map (name: "zfsunlock-${name}")
|
|
(builtins.attrNames config.mj.services.zfsunlock.targets);
|
|
};
|
|
}
|