Move dropbear role to modules

modules/default.nix

@@ -1,5 +1,5 @@
 { config, pkgs, ... }: {
 
-  imports = [ ./router ./router-dhcp ./router-dns ./router-wireless-ap ./wwan ];
+  imports = [ ./router ./router-dhcp ./router-dns ./router-wireless-ap ./wwan ./luks-ssh ];
 
 }

modules/luks-ssh/default.nix

@@ -0,0 +1,80 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.services.dropbear;
+in {
+  options.services.dropbear = {
+    enable = mkEnableOption "dropbear service";
+
+    interface = mkOption {
+      type = types.str;
+      example = "enp0";
+      description = ''
+        Interface name.
+      '';
+    };
+
+    ip = mkOption {
+      type = types.str;
+      example = "192.168.0.1";
+      description = ''
+        Host IP Address.
+      '';
+    };
+
+    gateway = mkOption {
+      type = types.str;
+      example = "192.168.0.1";
+      description = ''
+        IP of gateway.
+      '';
+    };
+
+    netmask = mkOption {
+      type = types.str;
+      example = "192.168.0.1";
+      description = ''
+        Netmask of internal network.
+      '';
+    };
+
+    sshPort = mkOption {
+      type = types.addCheck types.int (n: n > 0 && n < 65536);
+      default = 2222;
+      description = ''
+        SSH Port of the dropbear deamon.
+        Should be different from default SSH port to prevent known hosts collissions.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    boot.initrd.network = {
+      enable = true;
+      ssh = {
+        enable = true;
+        port = cfg.sshPort;
+        authorizedKeys = with lib;
+          concatLists (mapAttrsToList (name: user:
+            if elem "wheel" user.extraGroups then
+              user.openssh.authorizedKeys.keys
+            else
+              [ ]) config.users.users);
+        # Generate hostkey with ssh-keygen -t ed25519 -N "" -f /secrets/initrd_ssh_key_ed25519
+        hostKeys = [ "/secrets/initrd_ssh_key_ed25519" ];
+      };
+      postCommands = ''
+        echo 'cryptsetup-askpass' >> /root/.profile
+      '';
+    };
+
+    boot.kernelParams = [
+      "ip=${cfg.ip}::${cfg.gateway}:${cfg.netmask}:${config.networking.hostName}:${cfg.interface}:none"
+    ]; # see https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
+
+    boot.initrd.postMountCommands = ''
+      ip link set ${cfg.interface} down
+    '';
+  };
+}