In reply to @matthewcroughan:defenestrate.it
Hopefully zfs goes away and we get all the features in bcachefs

[root@nixos:~]# zfs list
NAME                    USED  AVAIL     REFER  MOUNTPOINT
rpool                   889M  35.5G       25K  /rpool
rpool/local             888M  35.5G       24K  /rpool/local
rpool/local/nix         888M  35.5G      888M  legacy
rpool/local/stash        24K  35.5G       24K  legacy
rpool/root              322K  35.5G      300K  legacy
rpool/safe               72K  35.5G       24K  /rpool/safe
rpool/safe/home          24K  35.5G       24K  legacy
rpool/safe/persistent    24K  35.5G       24K  legacy

[root@nixos:~]# df H
df: H: No such file or directory

[root@nixos:~]# df -h
Filesystem             Size  Used Avail Use% Mounted on
devtmpfs               192M     0  192M   0% /dev
tmpfs                  1.9G     0  1.9G   0% /dev/shm
tmpfs                  959M  2.8M  957M   1% /run
tmpfs                  1.9G  320K  1.9G   1% /run/wrappers
rpool/root              36G  384K   36G   1% /
rpool/local/nix         37G  889M   36G   3% /nix
rpool                   36G  128K   36G   1% /rpool
rpool/safe              36G  128K   36G   1% /rpool/safe
rpool/local             36G  128K   36G   1% /rpool/local
rpool/local/stash       36G  128K   36G   1% /state/stash
rpool/safe/home         36G  128K   36G   1% /state/home
/dev/sda2              500M   42M  458M   9% /boot
rpool/safe/persistent   36G  128K   36G   1% /state/root
tmpfs                  384M     0  384M   0% /run/user/0

In reply to @matthewcroughan:defenestrate.it
this is equivalent to a typo, it should be possible to express a type in lib that catches this, hard though, I can see why there's no code written to catch this failure

In reply to @eyjhb:eyjhb.dk
Wondering, is there any option for copying over the keyFile to the remote host? E.g. using ssh :)

In reply to @eyjhb:eyjhb.dk
Wondering, is there any option for copying over the keyFile to the remote host? E.g. using ssh :)

In reply to @matthewcroughan:defenestrate.it
Why do that when you could bake the secret into the disk image

In reply to @matthewcroughan:defenestrate.it
if you're referring to nixos-anywhere, I wonder if they have a postDeploy/preDeploy hook that could be used for this, would be a good idea if not yet implemented

    packages.x86_64-linux.secretImage =
    let
      secretAdderVm = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          ({ config, ... }:
          let
            stateDir = config.services.tor.settings.DataDirectory;
          in
          {
            imports = [
              "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"
              ./tor-config.nix
            ];
            virtualisation.graphics = false;
            services.getty.autologinUser = "root";
            programs.bash.interactiveShellInit = ''
              if [ "$(tty)" = "/dev/ttyS0" ]; then
                mkdir /mnt
                unzstd ${self.images.pi}/sd-image/*.zst --output-dir-flat /tmp/shared
                chmod 700 /tmp/shared/*.img
                losetup -P /dev/loop0 /tmp/shared/*.img
                mount /dev/loop0p2 /mnt

                mkdir -p /mnt/${stateDir}
                cp -r ${stateDir}/onion /mnt/${stateDir}/onion
                chown -R ${toString config.ids.uids.tor}:${toString config.ids.gids.tor} /mnt/${stateDir}
                chmod -R 700 /mnt/${stateDir}
                umount /mnt
                losetup -d /dev/loop0

                for i in ${stateDir}/onion/*; do echo -e "\nOnion Service: $(basename $i) -> $(cat $i/hostname)" >> /tmp/shared/services; done
                shutdown now
              fi
            '';
          })
        ];
      };
    in
    nixpkgs.legacyPackages.x86_64-linux.writeScriptBin "addSecrets"
    ''
      rm nixos.qcow2
      export SHARED_DIR=$(mktemp -d)
      ${secretAdderVm.config.system.build.vm}/bin/run-nixos-vm
      cat $SHARED_DIR/services
      mv $SHARED_DIR/*.img .
    '';

* --extra-files <file...>
  files to copy into the new nixos installation
* --disk-encryption-keys <remote_path> <local_path>
  copy the contents of the file or pipe in local_path to remote_path in the installer environment,
  after kexec but before installation. Can be repeated.