87 lines
2.4 KiB
Nix
87 lines
2.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
mkUnlock =
|
|
{
|
|
sshEndpoint,
|
|
pingEndpoint,
|
|
remotePubkey,
|
|
pwFile,
|
|
pingTimeoutSec,
|
|
}:
|
|
let
|
|
timeoutStr = builtins.toString pingTimeoutSec;
|
|
in
|
|
''
|
|
set -x
|
|
# if host is reachable via "pingEndpoint", which, we presume is
|
|
# VPN (which implies the rootfs has been unlocked for VPN to work),
|
|
# exit successfully.
|
|
${pkgs.iputils}/bin/ping -q -W ${timeoutStr} -c 1 ${pingEndpoint} && exit 0
|
|
|
|
exec ${pkgs.openssh}/bin/ssh \
|
|
-i /etc/ssh/ssh_host_ed25519_key \
|
|
-o UserKnownHostsFile=none \
|
|
-o GlobalKnownHostsFile=/dev/null \
|
|
-o KnownHostsCommand="${pkgs.coreutils}/bin/echo ${sshEndpoint} ${remotePubkey}" \
|
|
root@${sshEndpoint} < "${pwFile}"
|
|
'';
|
|
in
|
|
{
|
|
options.mj.services.zfsunlock = with lib.types; {
|
|
enable = lib.mkEnableOption "remotely unlock zfs-encrypted root volumes";
|
|
|
|
targets = lib.mkOption {
|
|
default = { };
|
|
type = attrsOf (submodule {
|
|
options = {
|
|
sshEndpoint = lib.mkOption { type = str; };
|
|
pingEndpoint = lib.mkOption { type = str; };
|
|
pingTimeoutSec = lib.mkOption {
|
|
type = int;
|
|
default = 20;
|
|
};
|
|
remotePubkey = lib.mkOption { type = str; };
|
|
pwFile = lib.mkOption { type = path; };
|
|
startAt = lib.mkOption { type = either str (listOf str); };
|
|
};
|
|
});
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf config.mj.services.zfsunlock.enable {
|
|
systemd.services = lib.mapAttrs' (
|
|
name: cfg:
|
|
lib.nameValuePair "zfsunlock-${name}" {
|
|
description = "zfsunlock service for ${name}";
|
|
script = mkUnlock (builtins.removeAttrs cfg [ "startAt" ]);
|
|
serviceConfig = {
|
|
User = "root";
|
|
ProtectSystem = "strict";
|
|
};
|
|
}
|
|
) config.mj.services.zfsunlock.targets;
|
|
|
|
systemd.timers = lib.mapAttrs' (
|
|
name: cfg:
|
|
lib.nameValuePair "zfsunlock-${name}" {
|
|
description = "zfsunlock timer for ${name}";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = cfg.startAt;
|
|
};
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
}
|
|
) config.mj.services.zfsunlock.targets;
|
|
|
|
mj.base.unitstatus.units = map (name: "zfsunlock-${name}") (
|
|
builtins.attrNames config.mj.services.zfsunlock.targets
|
|
);
|
|
};
|
|
}
|