In reply to @me:linj.tech
another question: the before = [ "cryptsetup-pre.target" ] does not seem to work: 59:50 localhost systemd[1]: Reached target Local Encrypted Volumes (Pre). is before 59:50 localhost systemd[1]: pre-device-command.service: Deactivated successfully. in journal

In reply to @me:linj.tech
oneshot does not change this

It's weird that my pre-device-command.service and cryptsetup-pre.target stops after finishing running nixos activation script.

from man systemd.special:

this target (cryptsetup-pre.target) is particularly useful to ensure that a service is shut down only after all encrypted block devices are fully stopped.

In reply to @me:linj.tech
my keyfile has a pre-defined key in it

In reply to @me:linj.tech
emm, what I want is somewhat weird: generate a keyfile on the fly for luks without storing that keyfile in initrd

In reply to @elvishjerricco:matrix.org
I am curious what exactly you mean by this. If it's not randomly generated, then where is this key file you're actually trying to use?

mkdir -p ${luksKeyFileDir}
mount -t ramfs none ${luksKeyFileDir}
echo -n password > ${luksKeyFile}
chown 0:0 ${luksKeyFile}
chmod 0400 ${luksKeyFile}