2023-01-31 03:38:41 +00:00
|
|
|
{ config, lib, pkgs, sane-lib, utils, ... }:
|
2022-12-31 10:15:08 +00:00
|
|
|
|
|
|
|
let
|
2024-02-23 04:16:17 +00:00
|
|
|
persist-base = "/nix/persist";
|
2024-02-23 14:57:20 +00:00
|
|
|
origin = config.sane.persist.stores."cryptClearOnBoot".origin;
|
|
|
|
key = "${origin}.key";
|
|
|
|
backing = sane-lib.path.concat [ persist-base "crypt/clearedonboot" ];
|
2023-01-03 07:04:49 +00:00
|
|
|
in
|
2023-01-06 10:04:51 +00:00
|
|
|
lib.mkIf config.sane.persist.enable
|
2022-12-31 10:15:08 +00:00
|
|
|
{
|
2023-01-06 10:04:51 +00:00
|
|
|
sane.persist.stores."cryptClearOnBoot" = {
|
2023-01-04 01:54:13 +00:00
|
|
|
storeDescription = ''
|
|
|
|
stored to disk, but encrypted to an in-memory key and cleared on every boot
|
|
|
|
so that it's unreadable after power-off
|
|
|
|
'';
|
2023-01-31 03:36:15 +00:00
|
|
|
origin = lib.mkDefault "/mnt/persist/crypt/clearedonboot";
|
2023-01-03 07:04:49 +00:00
|
|
|
};
|
|
|
|
|
2022-12-31 10:15:08 +00:00
|
|
|
|
2024-02-23 14:57:20 +00:00
|
|
|
fileSystems."${origin}" = {
|
|
|
|
device = backing;
|
2022-12-31 10:15:08 +00:00
|
|
|
fsType = "fuse.gocryptfs";
|
|
|
|
options = [
|
2023-09-13 06:07:04 +00:00
|
|
|
# "nodev" # "Unknown parameter 'nodev'". gocryptfs requires this be passed as `-ko nodev`
|
2023-09-13 05:13:43 +00:00
|
|
|
# "nosuid" # "Unknown parameter 'nosuid'". gocryptfs requires this be passed as `-ko nosuid` (also, nosuid is default)
|
|
|
|
"allow_other" # root ends up being the user that mounts this, so need to make it visible to other users.
|
2023-01-31 03:36:15 +00:00
|
|
|
"passfile=${key}"
|
2023-06-10 23:21:42 +00:00
|
|
|
# "defaults" # "unknown flag: --defaults. Try 'gocryptfs -help'"
|
2022-12-31 10:15:08 +00:00
|
|
|
];
|
|
|
|
noCheck = true;
|
|
|
|
};
|
2023-01-04 03:57:24 +00:00
|
|
|
# let sane.fs know about our fileSystem and automatically add the appropriate dependencies
|
2024-02-23 14:57:20 +00:00
|
|
|
sane.fs."${origin}".mount = {
|
2023-01-04 11:22:26 +00:00
|
|
|
# technically the dependency on the keyfile is extraneous because that *happens* to
|
|
|
|
# be needed to init the store.
|
|
|
|
depends = let
|
2024-02-23 14:57:20 +00:00
|
|
|
cryptfile = config.sane.fs."${backing}/gocryptfs.conf";
|
2023-01-31 03:36:15 +00:00
|
|
|
keyfile = config.sane.fs."${key}";
|
2023-01-04 11:22:26 +00:00
|
|
|
in [ keyfile.unit cryptfile.unit ];
|
|
|
|
};
|
2022-12-31 12:31:49 +00:00
|
|
|
|
2023-01-04 09:28:59 +00:00
|
|
|
# let sane.fs know how to initialize the gocryptfs store,
|
|
|
|
# and that it MUST do so
|
2024-02-23 14:57:20 +00:00
|
|
|
sane.fs."${backing}/gocryptfs.conf".generated = let
|
2023-07-08 10:34:46 +00:00
|
|
|
script = pkgs.writeShellScript "init-gocryptfs-store" ''
|
2023-01-04 09:28:59 +00:00
|
|
|
backing="$1"
|
|
|
|
passfile="$2"
|
|
|
|
# clear the backing store
|
|
|
|
# TODO: we should verify that it's not mounted anywhere...
|
2023-09-12 04:58:56 +00:00
|
|
|
# - specifically, there's a bug here right now where if the `sane.fs`
|
|
|
|
# details change, a deploy onto a live system will restart this service,
|
|
|
|
# corrupting all of this store.
|
2023-01-04 09:28:59 +00:00
|
|
|
rm -rf "''${backing:?}"/*
|
|
|
|
${pkgs.gocryptfs}/bin/gocryptfs -quiet -passfile "$passfile" -init "$backing"
|
|
|
|
'';
|
2023-07-08 10:34:46 +00:00
|
|
|
in {
|
2024-02-23 14:57:20 +00:00
|
|
|
command = [ "${script}" backing key ];
|
2023-01-04 09:28:59 +00:00
|
|
|
# we need the key in order to initialize the store
|
2023-01-31 03:36:15 +00:00
|
|
|
depends = [ config.sane.fs."${key}".unit ];
|
2023-01-04 09:28:59 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
# let sane.fs know how to generate the key for gocryptfs
|
2023-07-08 10:34:46 +00:00
|
|
|
sane.fs."${key}".generated = let
|
|
|
|
script = pkgs.writeShellScript "gen-random-gocryptfs-key" ''
|
2023-01-04 09:28:59 +00:00
|
|
|
dd if=/dev/random bs=128 count=1 | base64 --wrap=0 > "$1"
|
|
|
|
'';
|
2023-07-08 10:34:46 +00:00
|
|
|
in {
|
2023-07-08 11:14:55 +00:00
|
|
|
command = [ "${script}" key ];
|
2023-01-04 09:28:59 +00:00
|
|
|
# no need for anyone else to be able to read the key
|
|
|
|
acl.mode = "0400";
|
|
|
|
};
|
2022-12-31 10:15:08 +00:00
|
|
|
|
|
|
|
# TODO: could add this *specifically* to the .mount file for the encrypted fs?
|
2023-01-03 12:00:49 +00:00
|
|
|
system.fsPackages = [ pkgs.gocryptfs ]; # fuse needs to find gocryptfs
|
2022-12-31 10:15:08 +00:00
|
|
|
}
|