nixos/modules/tasks/filesystems/ecryptfs.nix

   1 { config, lib, pkgs, ... }:
   2 # TODO: make ecryptfs work in initramfs?
   3
   4 with lib;
   5
   6 {
   7   config = mkIf (config.boot.supportedFilesystems.ecryptfs or false) {
   8     system.fsPackages = [ pkgs.ecryptfs ];
   9     security.wrappers = {
  10       "mount.ecryptfs_private" =
  11         { setuid = true;
  12           owner = "root";
  13           group = "root";
  14           source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";
  15         };
  16       "umount.ecryptfs_private" =
  17         { setuid = true;
  18           owner = "root";
  19           group = "root";
  20           source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private";
  21         };
  22     };
  23   };
  24 }