How to unlock some luks devices with a keyfile on a first luks device

@Zahrun Try using /etc/crypttab (see man crypttab) instead of boot.initrd.luks.devices (which fileSystems.<name>.encrypted is a convenience wrapper for). /etc/crypttab will cause systemd to generate proper unit dependencies between LUKS devices, mounts, and required mounts/devices for key files.

boot.initrd.luks.devices, however, puts all the LUKS devices in initrd, so if the necessary file systems aren’t marked neededForBoot, it can’t work. And even then, you need boot.initrd.systemd.enable for the proper dependency ordering to be done; the regular initrd will just do LUKS devices in bulk, without finding necessary file systems for key files in between.

1 Like