Decrypting Drives via USB on NixOS
Typing passwords is a chore It’s tedious and unlocking your drive in public is also less secure. Fortunately, you can handle the unlocking process using a simple 1$ USB stick. boot = { tmp.cleanOnBoot = true; loader.efi.canTouchEfiVariables = false; supportedFilesystems = [ "zfs" ]; loader.timeout = 1; loader.grub = { enable = true; device = "nodev"; enableCryptodisk = true; zfsSupport = true; efiSupport = true; efiInstallAsRemovable = true; mirroredBoots = [ { devices = [ "nodev" ]; path = "/boot"; } ]; }; initrd.kernelModules = [ "usb_storage" "vfat" "nls_cp437" ]; initrd.systemd = { enable = true; contents."/etc/fstab".text = '' LABEL=Usbkey /key vfat defaults,nofail,x-systemd.device-timeout=5 0 2 ''; }; initrd.luks.devices = { root = { device = "/dev/disk/by-uuid/dddddddd-dddd-dddd-dddd-dddddddddddd"; keyFile = "/key/KEYFILE"; fallbackToPassword = true; }; }; }; I use ZFS, but you can simply omit the options related to it. ...