1 import ./make-test-python.nix ({ lib, pkgs, ... }: {
2 name = "systemd-initrd-luks-password";
4 nodes.machine = { pkgs, ... }: {
7 emptyDiskImages = [ 512 512 ];
11 boot.loader.systemd-boot.enable = true;
13 environment.systemPackages = with pkgs; [ cryptsetup ];
14 boot.initrd.systemd = {
16 emergencyAccess = true;
19 specialisation.boot-luks.configuration = {
20 boot.initrd.luks.devices = lib.mkVMOverride {
21 # We have two disks and only type one password - key reuse is in place
22 cryptroot.device = "/dev/vdc";
23 cryptroot2.device = "/dev/vdd";
25 virtualisation.bootDevice = "/dev/mapper/cryptroot";
30 # Create encrypted volume
31 machine.wait_for_unit("multi-user.target")
32 machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
33 machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdd -")
35 # Boot from the encrypted disk
36 machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
37 machine.succeed("sync")
40 # Boot and decrypt the disk
42 machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
43 machine.send_console("supersecret\n")
44 machine.wait_for_unit("multi-user.target")
46 assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")