luksroot module: optionSet -> submodule
This commit is contained in:
Eric Sagnes
parent
55e437806a
commit
96f5788346
@ -236,165 +236,165 @@ in
|
||||
<filename>/dev/mapper/<replaceable>name</replaceable></filename>.
|
||||
'';
|
||||
|
||||
type = types.loaOf types.optionSet;
|
||||
type = with types; loaOf (submodule (
|
||||
{ name, ... }: { options = {
|
||||
|
||||
options = { name, ... }: { options = {
|
||||
|
||||
name = mkOption {
|
||||
visible = false;
|
||||
default = name;
|
||||
example = "luksroot";
|
||||
type = types.str;
|
||||
description = "Name of the unencrypted device in <filename>/dev/mapper</filename>.";
|
||||
};
|
||||
|
||||
device = mkOption {
|
||||
example = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08";
|
||||
type = types.str;
|
||||
description = "Path of the underlying encrypted block device.";
|
||||
};
|
||||
|
||||
header = mkOption {
|
||||
default = null;
|
||||
example = "/root/header.img";
|
||||
type = types.nullOr types.str;
|
||||
description = ''
|
||||
The name of the file or block device that
|
||||
should be used as header for the encrypted device.
|
||||
'';
|
||||
};
|
||||
|
||||
keyFile = mkOption {
|
||||
default = null;
|
||||
example = "/dev/sdb1";
|
||||
type = types.nullOr types.str;
|
||||
description = ''
|
||||
The name of the file (can be a raw device or a partition) that
|
||||
should be used as the decryption key for the encrypted device. If
|
||||
not specified, you will be prompted for a passphrase instead.
|
||||
'';
|
||||
};
|
||||
|
||||
keyFileSize = mkOption {
|
||||
default = null;
|
||||
example = 4096;
|
||||
type = types.nullOr types.int;
|
||||
description = ''
|
||||
The size of the key file. Use this if only the beginning of the
|
||||
key file should be used as a key (often the case if a raw device
|
||||
or partition is used as key file). If not specified, the whole
|
||||
<literal>keyFile</literal> will be used decryption, instead of just
|
||||
the first <literal>keyFileSize</literal> bytes.
|
||||
'';
|
||||
};
|
||||
|
||||
# FIXME: get rid of this option.
|
||||
preLVM = mkOption {
|
||||
default = true;
|
||||
type = types.bool;
|
||||
description = "Whether the luksOpen will be attempted before LVM scan or after it.";
|
||||
};
|
||||
|
||||
allowDiscards = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Whether to allow TRIM requests to the underlying device. This option
|
||||
has security implications; please read the LUKS documentation before
|
||||
activating it.
|
||||
'';
|
||||
};
|
||||
|
||||
yubikey = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.optionSet;
|
||||
description = ''
|
||||
The options to use for this LUKS device in Yubikey-PBA.
|
||||
If null (the default), Yubikey-PBA will be disabled for this device.
|
||||
'';
|
||||
|
||||
options = {
|
||||
twoFactor = mkOption {
|
||||
default = true;
|
||||
type = types.bool;
|
||||
description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
|
||||
};
|
||||
|
||||
slot = mkOption {
|
||||
default = 2;
|
||||
type = types.int;
|
||||
description = "Which slot on the Yubikey to challenge.";
|
||||
};
|
||||
|
||||
saltLength = mkOption {
|
||||
default = 16;
|
||||
type = types.int;
|
||||
description = "Length of the new salt in byte (64 is the effective maximum).";
|
||||
};
|
||||
|
||||
keyLength = mkOption {
|
||||
default = 64;
|
||||
type = types.int;
|
||||
description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
|
||||
};
|
||||
|
||||
iterationStep = mkOption {
|
||||
default = 0;
|
||||
type = types.int;
|
||||
description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
|
||||
};
|
||||
|
||||
gracePeriod = mkOption {
|
||||
default = 2;
|
||||
type = types.int;
|
||||
description = "Time in seconds to wait before attempting to find the Yubikey.";
|
||||
};
|
||||
|
||||
ramfsMountPoint = mkOption {
|
||||
default = "/crypt-ramfs";
|
||||
type = types.str;
|
||||
description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
|
||||
};
|
||||
|
||||
/* TODO: Add to the documentation of the current module:
|
||||
|
||||
Options related to the storing the salt.
|
||||
*/
|
||||
storage = {
|
||||
device = mkOption {
|
||||
default = "/dev/sda1";
|
||||
type = types.path;
|
||||
description = ''
|
||||
An unencrypted device that will temporarily be mounted in stage-1.
|
||||
Must contain the current salt to create the challenge for this LUKS device.
|
||||
'';
|
||||
};
|
||||
|
||||
fsType = mkOption {
|
||||
default = "vfat";
|
||||
type = types.str;
|
||||
description = "The filesystem of the unencrypted device.";
|
||||
};
|
||||
|
||||
mountPoint = mkOption {
|
||||
default = "/crypt-storage";
|
||||
type = types.str;
|
||||
description = "Path where the unencrypted device will be mounted during early boot.";
|
||||
};
|
||||
|
||||
path = mkOption {
|
||||
default = "/crypt-storage/default";
|
||||
type = types.str;
|
||||
description = ''
|
||||
Absolute path of the salt on the unencrypted device with
|
||||
that device's root directory as "/".
|
||||
'';
|
||||
};
|
||||
};
|
||||
name = mkOption {
|
||||
visible = false;
|
||||
default = name;
|
||||
example = "luksroot";
|
||||
type = types.str;
|
||||
description = "Name of the unencrypted device in <filename>/dev/mapper</filename>.";
|
||||
};
|
||||
};
|
||||
|
||||
}; };
|
||||
device = mkOption {
|
||||
example = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08";
|
||||
type = types.str;
|
||||
description = "Path of the underlying encrypted block device.";
|
||||
};
|
||||
|
||||
header = mkOption {
|
||||
default = null;
|
||||
example = "/root/header.img";
|
||||
type = types.nullOr types.str;
|
||||
description = ''
|
||||
The name of the file or block device that
|
||||
should be used as header for the encrypted device.
|
||||
'';
|
||||
};
|
||||
|
||||
keyFile = mkOption {
|
||||
default = null;
|
||||
example = "/dev/sdb1";
|
||||
type = types.nullOr types.str;
|
||||
description = ''
|
||||
The name of the file (can be a raw device or a partition) that
|
||||
should be used as the decryption key for the encrypted device. If
|
||||
not specified, you will be prompted for a passphrase instead.
|
||||
'';
|
||||
};
|
||||
|
||||
keyFileSize = mkOption {
|
||||
default = null;
|
||||
example = 4096;
|
||||
type = types.nullOr types.int;
|
||||
description = ''
|
||||
The size of the key file. Use this if only the beginning of the
|
||||
key file should be used as a key (often the case if a raw device
|
||||
or partition is used as key file). If not specified, the whole
|
||||
<literal>keyFile</literal> will be used decryption, instead of just
|
||||
the first <literal>keyFileSize</literal> bytes.
|
||||
'';
|
||||
};
|
||||
|
||||
# FIXME: get rid of this option.
|
||||
preLVM = mkOption {
|
||||
default = true;
|
||||
type = types.bool;
|
||||
description = "Whether the luksOpen will be attempted before LVM scan or after it.";
|
||||
};
|
||||
|
||||
allowDiscards = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Whether to allow TRIM requests to the underlying device. This option
|
||||
has security implications; please read the LUKS documentation before
|
||||
activating it.
|
||||
'';
|
||||
};
|
||||
|
||||
yubikey = mkOption {
|
||||
default = null;
|
||||
description = ''
|
||||
The options to use for this LUKS device in Yubikey-PBA.
|
||||
If null (the default), Yubikey-PBA will be disabled for this device.
|
||||
'';
|
||||
|
||||
type = with types; nullOr (submodule {
|
||||
options = {
|
||||
twoFactor = mkOption {
|
||||
default = true;
|
||||
type = types.bool;
|
||||
description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
|
||||
};
|
||||
|
||||
slot = mkOption {
|
||||
default = 2;
|
||||
type = types.int;
|
||||
description = "Which slot on the Yubikey to challenge.";
|
||||
};
|
||||
|
||||
saltLength = mkOption {
|
||||
default = 16;
|
||||
type = types.int;
|
||||
description = "Length of the new salt in byte (64 is the effective maximum).";
|
||||
};
|
||||
|
||||
keyLength = mkOption {
|
||||
default = 64;
|
||||
type = types.int;
|
||||
description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
|
||||
};
|
||||
|
||||
iterationStep = mkOption {
|
||||
default = 0;
|
||||
type = types.int;
|
||||
description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
|
||||
};
|
||||
|
||||
gracePeriod = mkOption {
|
||||
default = 2;
|
||||
type = types.int;
|
||||
description = "Time in seconds to wait before attempting to find the Yubikey.";
|
||||
};
|
||||
|
||||
ramfsMountPoint = mkOption {
|
||||
default = "/crypt-ramfs";
|
||||
type = types.str;
|
||||
description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
|
||||
};
|
||||
|
||||
/* TODO: Add to the documentation of the current module:
|
||||
|
||||
Options related to the storing the salt.
|
||||
*/
|
||||
storage = {
|
||||
device = mkOption {
|
||||
default = "/dev/sda1";
|
||||
type = types.path;
|
||||
description = ''
|
||||
An unencrypted device that will temporarily be mounted in stage-1.
|
||||
Must contain the current salt to create the challenge for this LUKS device.
|
||||
'';
|
||||
};
|
||||
|
||||
fsType = mkOption {
|
||||
default = "vfat";
|
||||
type = types.str;
|
||||
description = "The filesystem of the unencrypted device.";
|
||||
};
|
||||
|
||||
mountPoint = mkOption {
|
||||
default = "/crypt-storage";
|
||||
type = types.str;
|
||||
description = "Path where the unencrypted device will be mounted during early boot.";
|
||||
};
|
||||
|
||||
path = mkOption {
|
||||
default = "/crypt-storage/default";
|
||||
type = types.str;
|
||||
description = ''
|
||||
Absolute path of the salt on the unencrypted device with
|
||||
that device's root directory as "/".
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
});
|
||||
};
|
||||
|
||||
}; }));
|
||||
};
|
||||
|
||||
boot.initrd.luks.yubikeySupport = mkOption {
|
||||
|
||||
Loading…
Reference in New Issue
Block a user