add wip verity

Author: Mic92

lib/types/verity.nix

@@ -0,0 +1,125 @@
+{ config, options, lib, diskoLib, parent, device, ... }:
+{
+  options = {
+    type = lib.mkOption {
+      type = lib.types.enum [ "luks" ];
+      internal = true;
+      description = "Type";
+    };
+    device = lib.mkOption {
+      type = lib.types.str;
+      description = "Device to encrypt";
+      default = device;
+    };
+    name = lib.mkOption {
+      type = lib.types.str;
+      description = "Name of the LUKS";
+    };
+    keyFile = lib.mkOption {
+      type = lib.types.nullOr diskoLib.optionTypes.absolute-pathname;
+      default = null;
+      description = "DEPRECATED use passwordFile or settings.keyFile. Path to the key for encryption";
+      example = "/tmp/disk.key";
+    };
+    settings = lib.mkOption {
+      type = lib.types.attrsOf lib.types.anything;
+      default = { };
+      description = "veritysetup settings (as defined in configuration.nix in boot.initrd.luks.devices.<name>)";
+      example = ''{
+      };'';
+    };
+    additionalKeyFiles = lib.mkOption {
+      type = lib.types.listOf diskoLib.optionTypes.absolute-pathname;
+      default = [ ];
+      description = "Path to additional key files for encryption";
+      example = [ "/tmp/disk2.key" ];
+    };
+    extraFormatArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra arguments to pass to `cryptsetup luksFormat` when formatting";
+      example = [ "--pbkdf argon2id" ];
+    };
+    extraOpenArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra arguments to pass to `cryptsetup luksOpen` when opening";
+      example = [ "--timeout 10" ];
+    };
+    content = diskoLib.deviceType { parent = config; device = "/dev/mapper/${config.name}"; };
+    _parent = lib.mkOption {
+      internal = true;
+      default = parent;
+    };
+    _meta = lib.mkOption {
+      internal = true;
+      readOnly = true;
+      type = lib.types.functionTo diskoLib.jsonType;
+      default = dev:
+        lib.optionalAttrs (config.content != null) (config.content._meta dev);
+      description = "Metadata";
+    };
+    _create = diskoLib.mkCreateOption {
+      inherit config options;
+      default = lib.optionalString (config.content != null) config.content._create;
+    };
+    _mount = diskoLib.mkMountOption {
+      inherit config options;
+      default = lib.optionalString (config.content != null) config.content._mount;
+    };
+    _unmount = diskoLib.mkMountOption {
+      inherit config options;
+      default = lib.optionalAttrs (config.content != null) config.content._unmount;
+    };
+    _config = lib.mkOption {
+      internal = true;
+      readOnly = true;
+      default = [
+        ({config, ...}: {
+          # TODO: upstream this.
+          assertions = [
+            {
+              assertion = config.boot.inird.systemd.enable;
+              message = ''
+                veritysetup with disko requires systemd in the initrd to be enabled.
+              '';
+            }
+          ];
+          boot.initrd = {
+            availableKernelModules = [
+              "dm_mod"
+              "dm_verity"
+            ];
+            # We need LVM for dm-verity to work.
+            services.lvm.enable = true;
+
+            systemd = {
+              additionalUpstreamUnits = [
+                "veritysetup-pre.target"
+                "veritysetup.target"
+                "remote-veritysetup.target"
+              ];
+              storePaths = [
+                "${config.boot.initrd.systemd.package}/lib/systemd/systemd-veritysetup"
+                "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-veritysetup-generator"
+              ];
+            };
+          };
+        })
+      ] ++ (lib.optional (config.content != null) config.content._config);
+      description = "NixOS configuration";
+    };
+    _pkgs = lib.mkOption {
+      internal = true;
+      readOnly = true;
+      type = lib.types.functionTo (lib.types.listOf lib.types.package);
+      default = pkgs: [ pkgs.veritysetup ] ++ (lib.optionals (config.content != null) (config.content._pkgs pkgs));
+      description = "Packages";
+    };
+  };
+  config = {
+    postUnmountHook = ''
+      veritysetup format ${config.device} ${config.name} ${lib.concatStringsSep " " config.extraFormatArgs}
+    '';
+  };
+}