Unverified Commit 79448d6a authored by Adam C. Stephens's avatar Adam C. Stephens Committed by GitHub
Browse files

nixos/zfs: add option to load pool credentials into kernel keyring (#324918)

parents 3c130ca6 9a1d8f09

nixos/modules/tasks/filesystems/zfs.nix

+3 −1
Original line number Diff line number Diff line
@@ -233,7 +233,7 @@ let 
                    tries=3

                    success=false

                    while [[ $success != true ]] && [[ $tries -gt 0 ]]; do

                      ${systemd}/bin/systemd-ask-password --timeout=${toString cfgZfs.passwordTimeout} "Enter key for $ds:" | ${cfgZfs.package}/sbin/zfs load-key "$ds" \

                      ${systemd}/bin/systemd-ask-password ${lib.optionalString cfgZfs.useKeyringForCredentials ("--keyname=zfs-$ds")} --timeout=${toString cfgZfs.passwordTimeout} "Enter key for $ds:" | ${cfgZfs.package}/sbin/zfs load-key "$ds" \

                        && success=true \

                        || tries=$((tries - 1))

                    done
@@ -403,6 +403,8 @@ in 
        '';

      };



      useKeyringForCredentials = lib.mkEnableOption "Uses the kernel keyring for encryption credentials with keyname=zfs-<poolname>";



      passwordTimeout = lib.mkOption {

        type = lib.types.int;

        default = 0;