cleanup boot files

2026-10-02 18:39:59 -05:00 · 2026-10-02 18:39:59 -05:00 · eca65aa860
commit eca65aa860
parent 7eb0a715ea
6 changed files with 113 additions and 98 deletions
--- a/hosts/apollo/boot/encryption.nix
+++ b/hosts/apollo/boot/encryption.nix
@ -0,0 +1,41 @@
+{ pkgs, lib, inputs, ... }:
+
+{
+  boot = {
+    # Luks Decryption for ZFS
+    initrd = {
+      supportedFilesystems = [ "ext4" "zfs" ];
+      availableKernelModules = [ "hid_apple" ];
+      systemd = {
+        enable = true;
+        fido2.enable = true;
+        emergencyAccess = true;
+        mounts = [
+          {
+            what = "/dev/mapper/zfs-keys";
+            where = "/keys";
+            type = "ext4";
+            options = "ro";
+          }
+        ];
+      };
+      luks.fido2Support = false;
+
+      luks.devices."zfs-keys" = {
+        device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part2";
+        crypttabExtraOpts = [ "fido2-device=auto" ];
+      };
+
+      systemd.services."zfs-import-nix-root" = {
+        wants = [ "keys.mount" ];
+        after = [ "keys.mount" ];
+      };
+
+    };
+  };
+
+  systemd.services."zfs-import-nix-main" = {
+    wants = [ "keys.mount" ];
+    after = [ "keys.mount" ];
+  };  
+}