# Using immutable users with impermanence on LUKS?

**URL:** https://discourse.nixos.org/t/using-immutable-users-with-impermanence-on-luks/43459
**Category:** Help
**Created:** [April 15, 2024, 10:15pm UTC](https://discourse.nixos.org/t/using-immutable-users-with-impermanence-on-luks/43459 "2024-04-15T22:15:04Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![kiara](https://discourse.nixos.org/user_avatar/discourse.nixos.org/kiara/32/37249_2.png) [@kiara](https://discourse.nixos.org/u/kiara)
#### Post date: [April 15, 2024, 10:15pm UTC](https://discourse.nixos.org/t/using-immutable-users-with-impermanence-on-luks/43459/1 "2024-04-15T22:15:04Z")

</div>

i use impermanence on LUKS, and recently came across the [`users.mutableUsers`](https://search.nixos.org/options?channel=unstable&show=users.mutableUsers&from=0&size=50&sort=relevance&type=packages&query=users.mutableUsers) option.  
making this immutable makes sense to me, but i’ve yet to really make this work.

specifically, in this setup i couldn’t get the ephemeral rollback script to work by either:

- initrd (`boot.initrd.postDeviceCommands`): due to error [`systemd stage 1 does not support 'boot.initrd.${name}'. Please convert it to analogous systemd units in 'boot.initrd.systemd'.`](https://github.com/NixOS/nixpkgs/pull/226237/files#diff-68fef76b66b99ee77baba62969a434c1f912c2fcf8765bfc884b7aa5b0e70d35R344-R345)
- systemd (`boot.initrd.systemd`): triggers before disk decryption, i.e. when there isn’t a disk to wipe yet.

has anyone figured out how to get this combination to work? am i looking in the wrong direction?

---

<div class="post-metadata">

### Author: ![ElvishJerricco](https://discourse.nixos.org/user_avatar/discourse.nixos.org/elvishjerricco/32/984_2.png) [@ElvishJerricco](https://discourse.nixos.org/u/ElvishJerricco)
#### Post date: [April 15, 2024, 10:23pm UTC](https://discourse.nixos.org/t/using-immutable-users-with-impermanence-on-luks/43459/2 "2024-04-15T22:23:26Z")

</div>

> [@kiara](#):
>
> systemd (`boot.initrd.systemd`): triggers before disk decryption, i.e. when there isn’t a disk to wipe yet.

You have to order your systemd service after the device you want to wipe. e.g.

```auto
boot.initrd.systemd.services.wipe-my-fs = {
  requires = ["dev-mapper-foo.device"];
  after = ["dev-mapper-foo.device"];
  wantedBy = ["initrd.target"];
  script = ''
    ...
  '';
};

```