There's a way to get encrypted swap + hibernate on Ubuntu. There's also a way to get encrypted swap on nixos (use randomEncryption.enable = true), and a way to make hibernate to swap. Is there a way to hibernate to encrypted swap?

  • As you probably noticed, randomEncryption is incompatible with hibernation. Have you tried the encrypted.* options? When I tried some time ago I got an error during the build, but perhaps it works now. – Emmanuel Rosa Jul 9 at 10:16
  • @EmmanuelRosa I don't see those options in the source. – nix Jul 9 at 20:10
  • It's in the encrypted-devices module: github.com/NixOS/nixpkgs/blob/master/nixos/modules/tasks/… – Emmanuel Rosa Jul 10 at 10:36
  • @EmmanuelRosa It looks like encrypted-devices needs a mounted partition to work (something in /etc/nixos/hardware-configuration.nix under filesystems) which swap isn't. – nix Jul 10 at 18:08

In a nutshell, to use hibernate on encrypted swap you'll need to create a keyfile which is then used to unlock the LUKS-encrypted swap partition. This is in contrast to using a random encryption key, an option not compatible with hibernation.

Of course, with this approach the location of the keyfile matters. You're best bet is to also encrypt your root filesystem, and then put the keyfile there, (ex. /root/swap.key). In this case, you'll be prompted for the root filesystem password during boot, which then makes the keyfile available to the boot process, so it then can unlock the swap LUKS container and use the "unlocked" device as a swap device.


NOTE: Consider these instructions a general guidance, rather than something you can simply copy-paste.

After booting the installation media...

Create your partitions, LUKS containers, filesystems and mount them.

Create a keyfile: dd count=1 bs=512 if=/dev/urandom of=/mnt/root/swap.key

Create and LUKS container for your encrypted swap, using the keyfile.

Unlock the swap LUKS container, format it with mkswap and activate it with swapon.

Proceed with generating the NixOS configuration. So far, it's like a normal NixOS installation.

Create a keyfile: dd count=1 bs=512 if=/dev/urandom of=/mnt/root/swap.key

Move the swapDevices configuration from /mnt/etc/nixos/hardware-configuration.nix to /mnt/etc/nixos/configuration.nix. Note: You'll need to repeat this step if you ever run nixos-generate-config again.

Edit swapDevices in /mnt/etc/nixos/configuration.nix to enable encryption. Here's an example:

swapDevices =
[ {
    device = "/dev/disk/by-uuid/..."; #This is already done for you. Leave as-is.
    encrypted = {
      enabled = true;
      keyFile = "/mnt-root/root/swap.key"; #Yes, /mnt-root is correct.
      label = "..."; The name used with `cryptsetup` when unlocking the LUKS container. It can be whatever you want, ex "luksswap".
      blkDev = "/dev/disk/by-uuid/[UUID of the LUKS partition]";

You can get the UUID of the LUKS partition with lsblk -o name,uuid.

Finally, nixos-rebuild boot and then reboot the system. Upon reboot NixOS will unlock the encrypted swap partition and activate it. If not, check journalctl -b for related errors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.