profiles/remote-unlock.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

{ adminUser, ... }:
{
  boot.kernelParams = [
    "ip=dhcp"
  ];

  boot.initrd.network = {
    enable = true;
    postCommands = "echo 'cryptsetup-askpass' >> /root/.profile";
    flushBeforeStage2 = true;
    ssh = {
      enable = true;
      port = 911;
      hostKeys = [
        "/etc/initrd/ssh_host_ed25519_key"
      ];
      authorizedKeys = with adminUser.userinfo.sshPublicKeys; [
        onepassword
        yubikey-personal-nano
        yubikey-personal-keychain
        yubikey-personal-backup
      ];
    };
  };
}