5

There's a way to get encrypted swap + hibernate on Ubuntu. There's also a way to get encrypted swap on nixos (use randomEncryption.enable = true), and a way to make hibernate to swap. Is there a way to hibernate to encrypted swap?

4
  • As you probably noticed, randomEncryption is incompatible with hibernation. Have you tried the encrypted.* options? When I tried some time ago I got an error during the build, but perhaps it works now. Commented Jul 9, 2019 at 10:16
  • @EmmanuelRosa I don't see those options in the source.
    – nix
    Commented Jul 9, 2019 at 20:10
  • It's in the encrypted-devices module: github.com/NixOS/nixpkgs/blob/master/nixos/modules/tasks/… Commented Jul 10, 2019 at 10:36
  • @EmmanuelRosa It looks like encrypted-devices needs a mounted partition to work (something in /etc/nixos/hardware-configuration.nix under filesystems) which swap isn't.
    – nix
    Commented Jul 10, 2019 at 18:08

2 Answers 2

3

In a nutshell, to use hibernate on encrypted swap you'll need to create a keyfile which is then used to unlock the LUKS-encrypted swap partition. This is in contrast to using a random encryption key, an option not compatible with hibernation.

Of course, with this approach the location of the keyfile matters. You're best bet is to also encrypt your root filesystem, and then put the keyfile there, (ex. /root/swap.key). In this case, you'll be prompted for the root filesystem password during boot, which then makes the keyfile available to the boot process, so it then can unlock the swap LUKS container and use the "unlocked" device as a swap device.

Intructions

NOTE: Consider these instructions a general guidance, rather than something you can simply copy-paste.

After booting the installation media...

Create your partitions, LUKS containers, filesystems and mount them.

Create a keyfile: dd count=1 bs=512 if=/dev/urandom of=/mnt/root/swap.key

Create and LUKS container for your encrypted swap, using the keyfile.

Unlock the swap LUKS container, format it with mkswap and activate it with swapon.

Proceed with generating the NixOS configuration. So far, it's like a normal NixOS installation.

Create a keyfile: dd count=1 bs=512 if=/dev/urandom of=/mnt/root/swap.key

Move the swapDevices configuration from /mnt/etc/nixos/hardware-configuration.nix to /mnt/etc/nixos/configuration.nix. Note: You'll need to repeat this step if you ever run nixos-generate-config again.

Edit swapDevices in /mnt/etc/nixos/configuration.nix to enable encryption. Here's an example:

swapDevices =
[ {
    device = "/dev/disk/by-uuid/..."; #This is already done for you. Leave as-is.
    encrypted = {
      enable = true;
      keyFile = "/mnt-root/root/swap.key"; #Yes, /mnt-root is correct.
      label = "..."; The name used with `cryptsetup` when unlocking the LUKS container. It can be whatever you want, ex "luksswap".
      blkDev = "/dev/disk/by-uuid/[UUID of the LUKS partition]";
    };
  }
];

You can get the UUID of the LUKS partition with lsblk -o name,uuid.

Finally, nixos-rebuild boot and then reboot the system. Upon reboot NixOS will unlock the encrypted swap partition and activate it. If not, check journalctl -b for related errors.

4
0

So, my approach was:

  1. Create luks device with the same password as your main
    sudo cryptsetup -y -v luksFormat /dev/nvme0n1p1
    
  2. Reboot to make sure the UUID updates correctly (not sure why it changes after first reboot)
  3. Add configuration to mount the device in initrd:
    boot.initrd.luks.devices."swap".device = 
    "/dev/disk/by-uuid/936542de-2068-41b7-b804-741ec80a59c6";
    
  4. Reboot to make sure device opens correctly. If passwords are the same, luks will ask for it only once and will try to open all devices with the same password.
  5. Add plain config with UUID of opened volume, obtained with blkid:
      swapDevices =
        [{ device = "/dev/disk/by-uuid/772a37e9-c010-4942-8f3d-b7f645092b02"; }];
    
  6. Hibernate with pm-hibernate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .