Commit 9a1d8f09 authored by Shawn8901's avatar Shawn8901
Browse files

zfs: add option to use kernel keyring for encryption credentials

parent f90d0a33

nixos/modules/tasks/filesystems/zfs.nix

+3 −1
Original line number Diff line number Diff line
@@ -233,7 +233,7 @@ let 
                    tries=3

                    success=false

                    while [[ $success != true ]] && [[ $tries -gt 0 ]]; do

                      ${systemd}/bin/systemd-ask-password --timeout=${toString cfgZfs.passwordTimeout} "Enter key for $ds:" | ${cfgZfs.package}/sbin/zfs load-key "$ds" \

                      ${systemd}/bin/systemd-ask-password ${lib.optionalString cfgZfs.useKeyringForCredentials ("--keyname=zfs-$ds")} --timeout=${toString cfgZfs.passwordTimeout} "Enter key for $ds:" | ${cfgZfs.package}/sbin/zfs load-key "$ds" \

                        && success=true \

                        || tries=$((tries - 1))

                    done
@@ -403,6 +403,8 @@ in 
        '';

      };



      useKeyringForCredentials = lib.mkEnableOption "Uses the kernel keyring for encryption credentials with keyname=zfs-<poolname>";



      passwordTimeout = lib.mkOption {

        type = lib.types.int;

        default = 0;