diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index f2755b49f88..1f412fe2d8f 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -236,165 +236,165 @@ in
/dev/mapper/name.
'';
- type = types.loaOf types.optionSet;
+ type = with types; loaOf (submodule (
+ { name, ... }: { options = {
- options = { name, ... }: { options = {
-
- name = mkOption {
- visible = false;
- default = name;
- example = "luksroot";
- type = types.str;
- description = "Name of the unencrypted device in /dev/mapper.";
- };
-
- device = mkOption {
- example = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08";
- type = types.str;
- description = "Path of the underlying encrypted block device.";
- };
-
- header = mkOption {
- default = null;
- example = "/root/header.img";
- type = types.nullOr types.str;
- description = ''
- The name of the file or block device that
- should be used as header for the encrypted device.
- '';
- };
-
- keyFile = mkOption {
- default = null;
- example = "/dev/sdb1";
- type = types.nullOr types.str;
- description = ''
- The name of the file (can be a raw device or a partition) that
- should be used as the decryption key for the encrypted device. If
- not specified, you will be prompted for a passphrase instead.
- '';
- };
-
- keyFileSize = mkOption {
- default = null;
- example = 4096;
- type = types.nullOr types.int;
- description = ''
- The size of the key file. Use this if only the beginning of the
- key file should be used as a key (often the case if a raw device
- or partition is used as key file). If not specified, the whole
- keyFile will be used decryption, instead of just
- the first keyFileSize bytes.
- '';
- };
-
- # FIXME: get rid of this option.
- preLVM = mkOption {
- default = true;
- type = types.bool;
- description = "Whether the luksOpen will be attempted before LVM scan or after it.";
- };
-
- allowDiscards = mkOption {
- default = false;
- type = types.bool;
- description = ''
- Whether to allow TRIM requests to the underlying device. This option
- has security implications; please read the LUKS documentation before
- activating it.
- '';
- };
-
- yubikey = mkOption {
- default = null;
- type = types.nullOr types.optionSet;
- description = ''
- The options to use for this LUKS device in Yubikey-PBA.
- If null (the default), Yubikey-PBA will be disabled for this device.
- '';
-
- options = {
- twoFactor = mkOption {
- default = true;
- type = types.bool;
- description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
- };
-
- slot = mkOption {
- default = 2;
- type = types.int;
- description = "Which slot on the Yubikey to challenge.";
- };
-
- saltLength = mkOption {
- default = 16;
- type = types.int;
- description = "Length of the new salt in byte (64 is the effective maximum).";
- };
-
- keyLength = mkOption {
- default = 64;
- type = types.int;
- description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
- };
-
- iterationStep = mkOption {
- default = 0;
- type = types.int;
- description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
- };
-
- gracePeriod = mkOption {
- default = 2;
- type = types.int;
- description = "Time in seconds to wait before attempting to find the Yubikey.";
- };
-
- ramfsMountPoint = mkOption {
- default = "/crypt-ramfs";
- type = types.str;
- description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
- };
-
- /* TODO: Add to the documentation of the current module:
-
- Options related to the storing the salt.
- */
- storage = {
- device = mkOption {
- default = "/dev/sda1";
- type = types.path;
- description = ''
- An unencrypted device that will temporarily be mounted in stage-1.
- Must contain the current salt to create the challenge for this LUKS device.
- '';
- };
-
- fsType = mkOption {
- default = "vfat";
- type = types.str;
- description = "The filesystem of the unencrypted device.";
- };
-
- mountPoint = mkOption {
- default = "/crypt-storage";
- type = types.str;
- description = "Path where the unencrypted device will be mounted during early boot.";
- };
-
- path = mkOption {
- default = "/crypt-storage/default";
- type = types.str;
- description = ''
- Absolute path of the salt on the unencrypted device with
- that device's root directory as "/".
- '';
- };
- };
+ name = mkOption {
+ visible = false;
+ default = name;
+ example = "luksroot";
+ type = types.str;
+ description = "Name of the unencrypted device in /dev/mapper.";
};
- };
- }; };
+ device = mkOption {
+ example = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08";
+ type = types.str;
+ description = "Path of the underlying encrypted block device.";
+ };
+
+ header = mkOption {
+ default = null;
+ example = "/root/header.img";
+ type = types.nullOr types.str;
+ description = ''
+ The name of the file or block device that
+ should be used as header for the encrypted device.
+ '';
+ };
+
+ keyFile = mkOption {
+ default = null;
+ example = "/dev/sdb1";
+ type = types.nullOr types.str;
+ description = ''
+ The name of the file (can be a raw device or a partition) that
+ should be used as the decryption key for the encrypted device. If
+ not specified, you will be prompted for a passphrase instead.
+ '';
+ };
+
+ keyFileSize = mkOption {
+ default = null;
+ example = 4096;
+ type = types.nullOr types.int;
+ description = ''
+ The size of the key file. Use this if only the beginning of the
+ key file should be used as a key (often the case if a raw device
+ or partition is used as key file). If not specified, the whole
+ keyFile will be used decryption, instead of just
+ the first keyFileSize bytes.
+ '';
+ };
+
+ # FIXME: get rid of this option.
+ preLVM = mkOption {
+ default = true;
+ type = types.bool;
+ description = "Whether the luksOpen will be attempted before LVM scan or after it.";
+ };
+
+ allowDiscards = mkOption {
+ default = false;
+ type = types.bool;
+ description = ''
+ Whether to allow TRIM requests to the underlying device. This option
+ has security implications; please read the LUKS documentation before
+ activating it.
+ '';
+ };
+
+ yubikey = mkOption {
+ default = null;
+ description = ''
+ The options to use for this LUKS device in Yubikey-PBA.
+ If null (the default), Yubikey-PBA will be disabled for this device.
+ '';
+
+ type = with types; nullOr (submodule {
+ options = {
+ twoFactor = mkOption {
+ default = true;
+ type = types.bool;
+ description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
+ };
+
+ slot = mkOption {
+ default = 2;
+ type = types.int;
+ description = "Which slot on the Yubikey to challenge.";
+ };
+
+ saltLength = mkOption {
+ default = 16;
+ type = types.int;
+ description = "Length of the new salt in byte (64 is the effective maximum).";
+ };
+
+ keyLength = mkOption {
+ default = 64;
+ type = types.int;
+ description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
+ };
+
+ iterationStep = mkOption {
+ default = 0;
+ type = types.int;
+ description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
+ };
+
+ gracePeriod = mkOption {
+ default = 2;
+ type = types.int;
+ description = "Time in seconds to wait before attempting to find the Yubikey.";
+ };
+
+ ramfsMountPoint = mkOption {
+ default = "/crypt-ramfs";
+ type = types.str;
+ description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
+ };
+
+ /* TODO: Add to the documentation of the current module:
+
+ Options related to the storing the salt.
+ */
+ storage = {
+ device = mkOption {
+ default = "/dev/sda1";
+ type = types.path;
+ description = ''
+ An unencrypted device that will temporarily be mounted in stage-1.
+ Must contain the current salt to create the challenge for this LUKS device.
+ '';
+ };
+
+ fsType = mkOption {
+ default = "vfat";
+ type = types.str;
+ description = "The filesystem of the unencrypted device.";
+ };
+
+ mountPoint = mkOption {
+ default = "/crypt-storage";
+ type = types.str;
+ description = "Path where the unencrypted device will be mounted during early boot.";
+ };
+
+ path = mkOption {
+ default = "/crypt-storage/default";
+ type = types.str;
+ description = ''
+ Absolute path of the salt on the unencrypted device with
+ that device's root directory as "/".
+ '';
+ };
+ };
+ };
+ });
+ };
+
+ }; }));
};
boot.initrd.luks.yubikeySupport = mkOption {