blob: 417daaf4499c12db32a0dbe8bffb2f2a7690d2b2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.boot.initrd.clevisLuksAskpass;
in
{
options = {
boot.initrd.clevisLuksAskpass.enable = lib.mkEnableOption ''
clevis-luks-askpass in initrd.
Watches for systemd password requests during boot and answers them
using clevis tokens bound to LUKS headers. Runs in parallel with
the interactive password prompt. If clevis cannot unlock a device
(tang unreachable, no binding, etc.) the user can still type the
passphrase.
Prerequisites:
- Bind clevis to each LUKS device:
clevis luks bind -d /dev/xxx tang '{"url":"..."}'
- Configure networking in the initrd so tang servers are reachable
'';
boot.initrd.clevisLuksAskpass.package = lib.mkPackageOption pkgs "clevis" { };
boot.initrd.clevisLuksAskpass.useTang = lib.mkOption {
description = "Whether the Clevis headers used to decrypt the devices uses a Tang server as a pin.";
default = false;
type = lib.types.bool;
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = config.boot.initrd.systemd.enable;
message = "clevis-luks-askpass requires boot.initrd.systemd.enable = true";
}
];
warnings =
if
cfg.useTang && !config.boot.initrd.network.enable && !config.boot.initrd.systemd.network.enable
then
[ "In order to use a Tang pinned secret you must configure networking in initrd" ]
else
[ ];
boot.initrd.systemd = {
# Install upstream clevis-luks-askpass.path and clevis-luks-askpass.service into the initrd
packages = [ cfg.package ];
storePaths = [
cfg.package
"${config.systemd.package}/lib/systemd/systemd-reply-password"
"${pkgs.jose}/bin/jose"
"${pkgs.curl}/bin/curl"
"${pkgs.cryptsetup}/bin/cryptsetup"
"${pkgs.gnused}/bin/sed"
"${pkgs.gnugrep}/bin/grep"
"${pkgs.gawk}/bin/gawk"
"${pkgs.coreutils}/bin/cat"
"${pkgs.luksmeta}/bin/luksmeta"
"${pkgs.tpm2-tools}/bin/tpm2_createprimary"
"${pkgs.tpm2-tools}/bin/tpm2_flushcontext"
"${pkgs.tpm2-tools}/bin/tpm2_load"
"${pkgs.tpm2-tools}/bin/tpm2_unseal"
];
# This is in the [Install] section of clevis-luks-askpass.path but that's not processed in nixos so we add it here
paths.clevis-luks-askpass = {
wantedBy = [ "cryptsetup.target" ];
};
services.clevis-luks-askpass = {
wants = lib.optional cfg.useTang "network-online.target";
after = lib.optional cfg.useTang "network-online.target";
};
};
};
}
|
