Well fileSystems fundamentally depend on the root FS already being mounted, so you can’t use them for anything that comes before the root FS is mounted. Something along these lines might work?
boot.initrd.systemd = {
contents."/my-encrypted-key".source = ./my-encrypted-key;
mounts = [
{
what = "none";
type = "tmpfs";
# /run/keys already belongs to nixos, but doesn't get mounted until too late
where = "/run/mykeys";
wantedBy = [ "initrd.target" ];
options = "defaults,noswap";
}
];
services."decrypt-my-key" = {
wantedBy = [ "initrd.target" ];
unitConfig = {
RequiresMountsFor = "/run/mykeys";
DefaultDependencies = false;
};
before = [ "zfs-import-${poolName}.service" ];
path = [
pkgs.age
pkgs.age-plugin-yubikey
];
script = ''
# I don't know what code you'd use, but the goal
# here is to decrypt the file that's in the
# initrd at /my-encrypted-key and store it
# somewhere in /run/mykeys/
'';
};
};
And then you’d just have your ZFS dataset’s keylocation property set to file:///run/mykeys/output-file