break out + ssh unlock

modules/nixos/default.nix

@@ -2,6 +2,8 @@
   base = import ./base.nix;
   binBashWrapper = import ./bin-bash-wrapper.nix;
   desktopHyprland = import ./desktop-hyprland.nix;
+  luksInitrdSshUnlock = import ./luks-initrd-ssh-unlock.nix;
+  luksTpm2 = import ./luks-tpm2.nix;
   mailServer = import ./mail-server;
   zfsRoot = import ./zfs-root.nix;
 }

modules/nixos/luks-initrd-ssh-unlock.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.initrdSshUnlock;
+in
+{
+  options.my.initrdSshUnlock = {
+    enable = lib.mkEnableOption "enable initrd SSH unlock";
+
+    authorizedKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "SSH public keys allowed to connect to initrd for disk unlock.";
+    };
+
+    hostKeyPath = lib.mkOption {
+      type = lib.types.path;
+      default = /etc/secrets/initrd/ssh_host_ed25519_key;
+      description = "Path to the initrd SSH host private key on the target system.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 2222;
+      description = "Port used by the initrd SSH server.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.kernelParams = [ "ip=dhcp" ];
+    boot.initrd.network = {
+      enable = true;
+      ssh = {
+        enable = true;
+        port = cfg.port;
+        hostKeys = [ (toString cfg.hostKeyPath) ];
+        authorizedKeys = cfg.authorizedKeys;
+      };
+    };
+    boot.initrd.secrets = {
+      "${toString cfg.hostKeyPath}" = cfg.hostKeyPath;
+    };
+
+    system.activationScripts.initrdSshHostKey = {
+      deps = [ "users" "groups" ];
+      text = ''
+        install -d -m 700 "$(dirname ${toString cfg.hostKeyPath})"
+        if [ ! -f "${toString cfg.hostKeyPath}" ]; then
+          ssh-keygen -t ed25519 -N "" -f "${toString cfg.hostKeyPath}"
+          chmod 600 "${toString cfg.hostKeyPath}"
+        fi
+      '';
+    };
+  };
+}

modules/nixos/luks-tpm2.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  boot.initrd.luks.devices.cryptroot.crypttabExtraOpts = [
+    "tpm2-device=auto"
+    "tpm2-pcrs=7"
+  ];
+
+  security.tpm2 = {
+    enable = true;
+    pkcs11.enable = true;
+    tctiEnvironment.enable = true;
+  };
+}

modules/nixos/zfs-root.nix

@@ -6,16 +6,6 @@
   boot.initrd.luks.devices.cryptroot = {
     device = "/dev/disk/by-partlabel/cryptroot";
     allowDiscards = true;
-    crypttabExtraOpts = [
-      "tpm2-device=auto"
-      "tpm2-pcrs=7"
-    ];
-  };
-
-  security.tpm2 = {
-    enable = true;
-    pkcs11.enable = true;
-    tctiEnvironment.enable = true;
   };
 
   services.zfs = {