starred/nix-config-ryan4yin
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-01-11 22:30:25 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

feat: replace impermanence with preservation (#198)

Browse Source 
* feat: replace impermanence with preservation

* fix: This module cannot be used with scripted initrd.

* fix: permission for /var/lib/private

* chore: boot.initrd.systemd.enable

* docs: boot.initrd.luks.devices.<name>.fallbackToPassword is implied by systemd stage 1

* fix: typo
This commit is contained in:
Ryan Yin
2025-06-29 13:02:36 +08:00
committed by GitHub
parent 763167ce0d
commit 8690978d7e
15 changed files with 382 additions and 219 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
secrets/nixos.nix
View File

@@ -45,7 +45,7 @@ in {
server.webserver.enable = mkEnableOption "NixOS Secrets for Web Servers(contains tls cert keys)";
server.storage.enable = mkEnableOption "NixOS Secrets for HDD Data's LUKS Encryption";
impermanence.enable = mkEnableOption "whether use impermanence and ephemeral root file system";
preservation.enable = mkEnableOption "whether use impermanence and ephemeral root file system";
};
config = mkIf (cfg.desktop.enable || enabledServerSecrets) (mkMerge [
@@ -56,7 +56,7 @@ in {
# if you changed this key, you need to regenerate all encrypt files from the decrypt contents!
age.identityPaths =
if cfg.impermanence.enable
if cfg.preservation.enable
then [
# To decrypt secrets on boot, this key should exists when the system is booting,
# so we should use the real key file path(prefixed by `/persistent/`) here, instead of the path mounted by impermanence.