diff --git a/README.md b/README.md index 487fd13..f55b8ce 100644 --- a/README.md +++ b/README.md @@ -372,10 +372,9 @@ Some references to websites that helped me create this repository: ## TODOs -* FDE remote SSH unlock: https://nixos.wiki/wiki/Remote_LUKS_Unlocking, https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote_unlocking_of_root_(or_other)_partition * Yubikey FDE: https://github.com/georgewhewell/nixos-host/blob/master/profiles/luks-yubi.nix -* Impermanence, opt-in to - persistence: https://github.com/Misterio77/nix-starter-configs/tree/main#try-opt-in-persistance +* Impermanence, opt-in to persistence: + https://github.com/Misterio77/nix-starter-configs/tree/main#try-opt-in-persistance * nix-shell / lorri * https://ghedam.at/15978/an-introduction-to-nix-shell * docker-compose.yml for services and nix-shell to run the code diff --git a/modules/fde-ssh-unlock.nix b/modules/fde-ssh-unlock.nix index 5d1bb00..52125cf 100644 --- a/modules/fde-ssh-unlock.nix +++ b/modules/fde-ssh-unlock.nix @@ -1,6 +1,12 @@ { config, pkgs, ... }: { + # Unlock encrypted root partition remotely with SSH. + # TODO: Some manual steps are required, see https://nixos.wiki/wiki/Remote_LUKS_Unlocking + # + # Additional references: + # https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote_unlocking_of_root_(or_other)_partition + # SSH in initrd boot.initrd.network.enable = true; boot.initrd.network.ssh = {