Nice! Remotely rebooting machines with encrypted disks is hard. I like that this approach is easy to setup.
It might be worth having your script check that the long-lived passphrase /LUKS-Passphrase-file.txt is only readable/writable by root, similar to how sshd (?) refuses to start if it notices your host keys are world readable.
If your machine has a TPM, GitHub - nix-community/lanzaboote: Secure Boot & Measured Boot for NixOS [maintainers=@blitz @raitobezarius @nikstur] · GitHub has an alternative approach.
If your threat model is having your device stolen, an alternative is zkj-nas-tools/revoke at master · stapelberg/zkj-nas-tools · GitHub which gets the LUKS passphrase from combining a secret that lives on an unencrypted disk, with a secret that is fetched over HTTPS from a remote server. It also has a HTTP endpoint for revoking that secret, if you are aware your device has been stolen, and want to prevent it being booted. I’ve been meaning to port that to the systemd-based initrd by implementing a Password Agents that does this.
Thanks for writing this up!
I ended up turning this into a flake to make it easier for other NixOS users to set this up without having to set it all up manually.
The flake is available here: GitHub - flyingpeakock/nixos-passphrase-less-reboot · GitHub