# How to unlock some luks devices with a keyfile on a first luks device

**URL:** https://discourse.nixos.org/t/how-to-unlock-some-luks-devices-with-a-keyfile-on-a-first-luks-device/18949
**Category:** Help
**Created:** [May 2, 2022, 2:04am UTC](https://discourse.nixos.org/t/how-to-unlock-some-luks-devices-with-a-keyfile-on-a-first-luks-device/18949 "2022-05-02T02:04:39Z")
**Posts on this page:** 1
**Showing post:** 12

<div class="post-metadata">

### Author: ![ElvishJerricco](https://discourse.nixos.org/user_avatar/discourse.nixos.org/elvishjerricco/32/984_2.png) [@ElvishJerricco](https://discourse.nixos.org/u/ElvishJerricco)
#### Post date: [January 29, 2023, 2:56pm UTC](https://discourse.nixos.org/t/how-to-unlock-some-luks-devices-with-a-keyfile-on-a-first-luks-device/18949/12 "2023-01-29T14:56:53Z")

</div>

@Zahrun Try using `/etc/crypttab` (see `man crypttab`) instead of `boot.initrd.luks.devices` (which `fileSystems.<name>.encrypted` is a convenience wrapper for). `/etc/crypttab` will cause systemd to generate proper unit dependencies between LUKS devices, mounts, and required mounts/devices for key files.

`boot.initrd.luks.devices`, however, puts all the LUKS devices in initrd, so if the necessary file systems aren’t marked `neededForBoot`, it can’t work. And even then, you need `boot.initrd.systemd.enable` for the proper dependency ordering to be done; the regular initrd will just do LUKS devices in bulk, without finding necessary file systems for key files in between.

---

_[View the full topic](https://discourse.nixos.org/t/how-to-unlock-some-luks-devices-with-a-keyfile-on-a-first-luks-device/18949)._