lib#

I am currently running this configuration inside virt-manager for a virtual machine.

I don’t currently have this setup for this use case, however it is something I plan to implement. The reason I don’t have this implemented is due to the way disks are shared within AWS. I can share this as an EBS volume, but there is more work that is needed like getting the disk uuid.

Virt-Manager Configuration#

When adding the disk, I have setup the additional disk to be a qcow2, and it has a serial configuration set to data.

Serial: data

When I map the device inside the OS, it shows up under /dev/disk/by-id/virtio-data

I had to format the disk with the following:

dd if=/dev/urandom of=/root/data.key bs=4096 count=1
chmod 0400 /root/data.key

cryptsetup luksFormat /dev/disk/by-id/virtio-data
cryptsetup luksAddKey /dev/disk/by-id/virtio-data /root/data.key

Before we add this to our configuration we can make sure it’s working by opening the device creating a mapper:

cryptsetup open \
  /dev/disk/by-id/virtio-data \
  data \
  --key-file /root/data.key

# Creates
/dev/mapper/data

# Inside the disk we can make a filesystem
mkfs.ext4 /dev/mapper/data

# Now we can mount and test...
mkdir -p /data
mount /dev/mapper/data /data
df -h /data

For persistence we can now add this to our Nix Configuration:

{
  boot.initrd.secrets."/root/data.key" = null;
  boot.initrd.luks.devices.data = {
    device = "/dev/disk/by-id/virtio-data";
    keyFile = "/root/data.key";
  };
  fileSystems."/data" = {
    device = "/dev/mapper/data";
    fsType = "ext4";
    options = ["nofail" "x-systemd.device-timeout=10s"];
  };
}

After it has been configured, we can now test out if everything is configured properly:

[root@nixos:~]# ls -l /dev/disk/by-id/ | grep data
lrwxrwxrwx 1 root root 10 Feb  7 11:00 dm-name-data -> ../../dm-0
lrwxrwxrwx 1 root root 10 Feb  7 11:00 dm-uuid-CRYPT-LUKS2-4f028b319d0d4e09a012ce6018a4593d-data -> ../../dm-0
lrwxrwxrwx 1 root root  9 Feb  7 11:00 virtio-data -> ../../vdb

[root@nixos:~]# lsblk -o NAME,SIZE,TYPE,MOUNTPOINT
NAME    SIZE TYPE  MOUNTPOINT
sr0    1024M rom
vda      64G disk
└─vda1   64G part  /
vdb      20G disk
└─data   20G crypt /data