Full disk encryption with ordering

ElvishJerricco · May 10, 2025, 8:13pm

If you use boot.initrd.systemd.enable, a lot of this will just be automatic. e.g. You can do this:

boot.initrd.luks.device = {
  usb.device = "UUID=asdf";
  root = {
    device = "UUID=hjkl";
    keyFile = "/dev/mapper/usb";
    crypttabExtraOpts = [ "keyfile-size=4096" ];
  };
};

With this, systemd-cryptsetup-generator will automatically add dependencies so this will be ordered correctly, including the root device depending on the usb device being decrypted.

If you’d rather the key be a file on the USB device instead of using the block device itself, you can just use a fancy keyFile

boot.initrd.luks.device = {
  usb.device = "UUID=asdf";
  root = {
    device = "UUID=hjkl";
    # Use the file /key from the /dev/mapper/usb file system
    keyFile = "/key:/dev/mapper/usb";
  };
};

EDIT 2026: The first example, using the decrypted mapper device itself as the keyfile, no longer works since we no longer patch systemd to make this work. The second example, with keyFile = "/key:/dev/mapper/usb"; does still work however, and IMO is preferable in general anyway.