Systemd initrd for USB based LUKS unlocking root

Help
8

I will admit I have never done usb-key based luks unlocking before. But I have done ssh-based luks unlocking before and I had similar systemd-ordering issues. So I can give you advice based on that.

  1. It is never enough to specify “Before” if you want a service to run before a different service. You also have to include “WantedBy” or “RequiredBy”. Same thing for “After” and “Wants/Requires”.

  2. Remember that you can override or add to attributes of services that you have not defined yourself. In the example below I enable ssh with network.ssh.enable = true so I never write the ssh initrd service myself. But I still add dependencies to the systemd service.

  3. If you want to find the name of the service based on the message that appears during boot then you can run journalctl -o verbose and just search for the message.

I posted my initrd config in a post completely unrelated to this. But you can still read it and maybe it will help. Running NetworkManager in initrd - #3 by zachliebl

In that config I want ssh to run before I decrypt my disks. Notice that I added the following lines:

        services."sshd".unitConfig.WantedBy = [
          "systemd-cryptsetup@argon_zfs_root_1.service"
          "systemd-cryptsetup@argon_zfs_root_2.service"
        ];
        services."sshd".unitConfig.Before = [
          "systemd-cryptsetup@argon_zfs_root_1.service"
          "systemd-cryptsetup@argon_zfs_root_2.service"
        ];