break out + ssh unlock

2026-04-07 20:37:56 +02:00
parent 76b7441884
commit 8ede23da35
6 changed files with 82 additions and 12 deletions
@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.initrdSshUnlock;
+in
+{
+  options.my.initrdSshUnlock = {
+    enable = lib.mkEnableOption "enable initrd SSH unlock";
+
+    authorizedKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "SSH public keys allowed to connect to initrd for disk unlock.";
+    };
+
+    hostKeyPath = lib.mkOption {
+      type = lib.types.path;
+      default = /etc/secrets/initrd/ssh_host_ed25519_key;
+      description = "Path to the initrd SSH host private key on the target system.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 2222;
+      description = "Port used by the initrd SSH server.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.kernelParams = [ "ip=dhcp" ];
+    boot.initrd.network = {
+      enable = true;
+      ssh = {
+        enable = true;
+        port = cfg.port;
+        hostKeys = [ (toString cfg.hostKeyPath) ];
+        authorizedKeys = cfg.authorizedKeys;
+      };
+    };
+    boot.initrd.secrets = {
+      "${toString cfg.hostKeyPath}" = cfg.hostKeyPath;
+    };
+
+    system.activationScripts.initrdSshHostKey = {
+      deps = [ "users" "groups" ];
+      text = ''
+        install -d -m 700 "$(dirname ${toString cfg.hostKeyPath})"
+        if [ ! -f "${toString cfg.hostKeyPath}" ]; then
+          ssh-keygen -t ed25519 -N "" -f "${toString cfg.hostKeyPath}"
+          chmod 600 "${toString cfg.hostKeyPath}"
+        fi
+      '';
+    };
+  };
+}