Ah, interesting. So, I know what’s happening there. The wpa_supplicant@.service unit is waiting for sysinit.target because of the default dependencies of service units. This means waiting for encrypted devices. We had the same problem with sshd, and we solved it by just adding DefaultDependencies=false. You could do the same with the wpa_supplicant service with boot.initrd.systemd.services."wpa_supplicant@".unitConfig.DefaultDependencies = false; I think. But I do wonder if we should just change something so that encrypted devices aren’t a part of sysinit.target in initrd, since sysinit.target means something slightly different in initrd. Then neither you nor the sshd module would have to work around it
Oh, and that page seems basically entirely irrelevant to NixOS’s initrd configuration.