When you’re root user, you can extract the unlocked LUKS main key from RAM and can use that to add a key.

By default, if systemd-boot is used and no kernel was loaded manually using kexec -l before, systemd will load the kernel specified in the default boot loader entry. For example, to reboot into the newer kernel after a system update, you may simply run:

name: "Build NixOS configurations"
on:
  pull_request:
    paths:
      - .forgejo/workflows/build.yml
      - flake.lock
      - '**.nix'
  push:
    branches:
      - master
    paths:
      - .forgejo/worflows/build.yml
      - flake.lock
      - '**.nix'
  workflow_dispatch:

jobs:
  build:
    runs-on: native
    strategy:
      matrix:
        host:
          - name: eris
            system: aarch64-linux
          - name: ganymede
            system: x86_64-linux
          - name: helios
            system: x86_64-linux
          - name: io
            system: x86_64-linux
          - name: juno
            system: x86_64-linux
          - name: meduna
            system: x86_64-linux
          - name: pallas
            system: aarch64-linux
    steps:
    - uses: actions/checkout@v4
    - name: Configure attic cache
      run: |
        attic login "${{ secrets.ATTIC_CACHE }}" "${{ secrets.ATTIC_ENDPOINT }}" "${{ secrets.ATTIC_TOKEN}}"
    - name: Configure Nix-Community CUDA cache
      run: |
        cachix use nix-community
      if: matrix.host.name == 'meduna'
    - name: Build system closure
      run: |
          nix run \
            --inputs-from . \
            nixpkgs#nix-fast-build \
            -- \
            --eval-workers 4 \
            --systems "${{ matrix.host.system }}" \
            --attic-cache "${{ secrets.ATTIC_CACHE }}" \
            --no-nom \
            --flake ".#nixosConfigurations.${{ matrix.host.name }}.config.system.build.toplevel"