NixOS/disko
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

luks: improve idempotency for enrolling FIDO2

Browse Source 
Using FIDO2 automatically generates a temporary password for setting up LUKS
which is not available on subsequent runs of the script causing the format
script to crash with `password: unbound variable`.
This commit is contained in:
Michael Hoang
2026-05-20 00:07:06 +02:00
parent 65fb947964
commit d60b2b5e00
1 changed files with 35 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/types/luks.nix
+35 -29
View File
@@ -236,44 +236,50 @@ in
${toString (
lib.forEach config.additionalKeyFiles (keyFile: ''
cryptsetup luksAddKey "${config.device}" ${keyFile} ${formatKeyFileArgs}
if ! cryptsetup open --test-passphrase --key-file=${keyFile} "${config.device}" 2>/dev/null; then
cryptsetup luksAddKey "${config.device}" ${keyFile} ${formatKeyFileArgs}
fi
'')
)}
${lib.optionalString config.enrollRecovery ''
systemd-cryptenroll \
--recovery-key \
--unlock-key-file=${formatKeyFile} \
"${config.device}"
if [ -z ''${IN_DISKO_TEST+x} ]; then
set +x; read -p "Press Enter when you scanned the QR code offscreen or that the recovery key is stored securely."; set -x
if ! systemd-cryptenroll "${config.device}" 2>/dev/null | grep -qw recovery; then
systemd-cryptenroll \
--recovery-key \
--unlock-key-file=${formatKeyFile} \
"${config.device}"
if [ -z ''${IN_DISKO_TEST+x} ]; then
set +x; read -p "Press Enter when you scanned the QR code offscreen or that the recovery key is stored securely."; set -x
fi
fi
''}
${lib.optionalString config.enrollFido2 ''
wait_for_token() {
set +f
echo "Waiting for FIDO2 token insertion..."
if ! systemd-cryptenroll "${config.device}" 2>/dev/null | grep -qw fido2; then
wait_for_token() {
set +f
echo "Waiting for FIDO2 token insertion..."
# Check if any FIDO2 device is available via /dev/hidraw*
while true; do
if ls /dev/hidraw* &>/dev/null; then
echo "FIDO2 device detected."
break
else
echo "FIDO2 device not detected, waiting..."
sleep 2
fi
done
set -f
}
# Check if any FIDO2 device is available via /dev/hidraw*
while true; do
if ls /dev/hidraw* &>/dev/null; then
echo "FIDO2 device detected."
break
else
echo "FIDO2 device not detected, waiting..."
sleep 2
fi
done
set -f
}
wait_for_token
systemd-cryptenroll \
--fido2-device=auto \
''${SLOT_ZERO_TO_DELETE:+--wipe-slot=0} \
--unlock-key-file=${formatKeyFile} \
${toString config.extraFido2EnrollArgs} \
"${config.device}"
wait_for_token
systemd-cryptenroll \
--fido2-device=auto \
''${SLOT_ZERO_TO_DELETE:+--wipe-slot=0} \
--unlock-key-file=${formatKeyFile} \
${toString config.extraFido2EnrollArgs} \
"${config.device}"
fi
''}
${lib.optionalString (config.content != null) config.content._create}
'';