encryption-configuration.local.nix.example

# Copy this file and remove the `.example` extension.
# This file adds encryption specific settings for `hardware-configuration.nix`

{ ... }:
{
    boot.initrd.luks.devices = {
        "sdXZ_crypt" = {
            keyFile = "/crypto_keyfile.bin";
            preLVM = true;
            #allowDiscards = true;
        };
        "swap_crypt" = {
            device = "/dev/disk/by-uuid/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX";
            keyFile = "/crypto_keyfile.bin";
            preLVM = true;
            #allowDiscards = true;
        };
    };
    boot.resumeDevice = "/dev/mapper/swap_crypt";

    # Data mount
    #fileSystems."/data" = {
    #    device = "/dev/mapper/data_crypt";
    #    fsType = "btrfs";
    #    options = [ "subvol=@data" ];
    #    encrypted = {
    #        enable = true;
    #        label = "data_crypt";
    #        blkDev = "/dev/disk/by-uuid/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"; # UUID for encrypted disk
    #        keyFile = "/crypto_keyfile.bin";
    #    };
    #};


    swapDevices = [
        { device = "/dev/mapper/swap_crypt"; }
        # In case swap is not encrypted in initrd to be used as resume device:
        #{ device = "/dev/mapper/swap_crypt";
        #    encrypted = {
        #        enable = true;
        #        label = "swap_crypt";
        #        blkDev = "/dev/disk/by-uuid/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"; # UUID for encrypted disk
        #        keyFile = "/crypto_keyfile.bin";
        #    };
        #}
    ];
}