845c9b50bf
This allows setting options for the same LUKS device in different modules. For example, the auto-generated hardware-configuration.nix can contain boot.initrd.luks.devices.crypted.device = "/dev/disk/..."; while configuration.nix can add boot.initrd.luks.devices.crypted.allowDiscards = true; Also updated the examples/docs to use /disk/disk/by-uuid instead of /dev/sda, since we shouldn't promote the use of the latter.
43 lines
1.4 KiB
XML
43 lines
1.4 KiB
XML
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-luks-file-systems">
|
|
|
|
<title>LUKS-Encrypted File Systems</title>
|
|
|
|
<para>NixOS supports file systems that are encrypted using
|
|
<emphasis>LUKS</emphasis> (Linux Unified Key Setup). For example,
|
|
here is how you create an encrypted Ext4 file system on the device
|
|
<filename>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</filename>:
|
|
|
|
<screen>
|
|
$ cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d
|
|
|
|
WARNING!
|
|
========
|
|
This will overwrite data on /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d irrevocably.
|
|
|
|
Are you sure? (Type uppercase yes): YES
|
|
Enter LUKS passphrase: ***
|
|
Verify passphrase: ***
|
|
|
|
$ cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted
|
|
Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
|
|
|
|
$ mkfs.ext4 /dev/mapper/crypted
|
|
</screen>
|
|
|
|
To ensure that this file system is automatically mounted at boot time
|
|
as <filename>/</filename>, add the following to
|
|
<filename>configuration.nix</filename>:
|
|
|
|
<programlisting>
|
|
boot.initrd.luks.devices.crypted.device = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
|
|
fileSystems."/".device = "/dev/mapper/crypted";
|
|
</programlisting>
|
|
|
|
</para>
|
|
|
|
</section>
|