qo.is/infrastructure
Watch
3
0
Fork
You've already forked infrastructure
 0
Code Issues 16 Pull requests 5 Projects 1 Activity Actions

Add systemd-initrd SSH LUKS unlock module for cyprianspitz #149

Merged
fabianhauser merged 2 commits from systemd-initrd-ssh-unlock into main 2026-07-23 14:03:26 +00:00
Conversation 0 Commits 2 Files changed 9 +197 -6
fabianhauser commented 2026-07-23 13:40:25 +00:00
Owner
Copy link

Summary

  • Adds nixos-modules/initrd-ssh-unlock (qois.initrd-ssh-unlock), implementing remote LUKS unlock over SSH via systemd initrd (per wiki.nixos.org/wiki/Remote_disk_unlocking), superseding the legacy busybox-initrd qois.luks-ssh module.
  • Migrates cyprianspitz to the new module; lindberg keeps using qois.luks-ssh for now, so both coexist under distinct option namespaces.
  • Authorized keys collected from wheel-group users are forced to run command="systemctl default", replacing the old cryptsetup-askpass-in-.profile trick (which doesn't exist under systemd stage 1).
  • Adds x-systemd.device-timeout=infinity to cyprianspitz's / and /mnt/data mounts so systemd doesn't time out while an admin is still SSHing in to unlock.
  • Adds a scoped NixOS VM test verifying systemd-initrd + networkd + ssh wiring and the command= wrapper (not a full LUKS-encrypted-root scenario).

Test plan

  • nix fmt
  • nix build .#nixosConfigurations.cyprianspitz.config.system.build.toplevel
  • nix build .#checks.x86_64-linux.nixos-modules.entries.vm-test-run-initrd-ssh-unlock
  • CI (nix flake check)
  • Real hardware verification on cyprianspitz (separate, deliberate maintenance window)
## Summary - Adds `nixos-modules/initrd-ssh-unlock` (`qois.initrd-ssh-unlock`), implementing remote LUKS unlock over SSH via systemd initrd (per wiki.nixos.org/wiki/Remote_disk_unlocking), superseding the legacy busybox-initrd `qois.luks-ssh` module. - Migrates `cyprianspitz` to the new module; `lindberg` keeps using `qois.luks-ssh` for now, so both coexist under distinct option namespaces. - Authorized keys collected from wheel-group users are forced to run `command="systemctl default"`, replacing the old `cryptsetup-askpass`-in-`.profile` trick (which doesn't exist under systemd stage 1). - Adds `x-systemd.device-timeout=infinity` to cyprianspitz's `/` and `/mnt/data` mounts so systemd doesn't time out while an admin is still SSHing in to unlock. - Adds a scoped NixOS VM test verifying systemd-initrd + networkd + ssh wiring and the `command=` wrapper (not a full LUKS-encrypted-root scenario). ## Test plan - [x] `nix fmt` - [x] `nix build .#nixosConfigurations.cyprianspitz.config.system.build.toplevel` - [x] `nix build .#checks.x86_64-linux.nixos-modules.entries.vm-test-run-initrd-ssh-unlock` - [x] CI (`nix flake check`) - [x] Real hardware verification on cyprianspitz (separate, deliberate maintenance window)
Add systemd-initrd SSH LUKS unlock module for cyprianspitz
All checks were successful
CI / build (push) Successful in 1m13s
Details
CI / deploy (docs-ops.qo.is) (push) Has been skipped
Details
CI / deploy (system-physical) (push) Has been skipped
Details
CI / deploy (system-vm) (push) Has been skipped
Details
CI / deploy-ci (push) Has been skipped
Details
da653f329b 
Supersedes the legacy busybox-initrd qois.luks-ssh module (which lindberg
still uses for now) with qois.initrd-ssh-unlock, following
wiki.nixos.org/wiki/Remote_disk_unlocking. Under systemd stage 1,
cryptsetup-askpass doesn't exist, so authorized keys are forced to run
`systemctl default` instead, and qois.system.physical's legacy
udhcpc/busybox-initrd defaults have to be force-overridden since systemd
stage 1 asserts against them.

Also bumps disko-config.nix's root and data mounts to
x-systemd.device-timeout=infinity, since systemd's default device timeout
would otherwise fire while an admin is still SSHing in to unlock.
Use cyprianspitz's static LAN IP for initrd SSH unlock instead of DHCP
All checks were successful
CI / build (push) Successful in 40s
Details
CI / deploy (docs-ops.qo.is) (push) Successful in 22s
Details
CI / deploy (system-vm) (push) Successful in 38s
Details
CI / deploy (system-physical) (push) Successful in 1m15s
Details
CI / deploy-ci (push) Successful in 26s
Details
f6ca52c0b3 
Matches the runtime network config (10.1.1.250/24 via calanda), so the
unlock address is always known ahead of time instead of depending on
calanda's DHCP pool (which doesn't even cover .250).
fabianhauser deleted branch systemd-initrd-ssh-unlock 2026-07-23 14:03:26 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
urgent
This issue should be tackled soon

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
urgent
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
qo.is/infrastructure!149
No description provided.