Title: Unlock a full disk encryption NixOS with usb memory stick

	Title: Unlock a full disk encryption NixOS with usb memory stick
	Author: Solène
	Date: 06 October 2020
	Tags: nixos linux
	Description:

	Using NixOS on a laptop on which the keyboard isn't detected when
	I need to type the password to decrypt disk, I had to find a solution.
	This problem is hardware related, not Linux or NixOS related.

	**I highly recommend using full disk encryption on every computer
	following a thief threat model. Having your computer stolen is bad,
	but if the thief has access to all your data, you will certainly
	be in trouble.**

	This was time to find how to use an usb memory stick to unlock the
	full disk encryption in case I don't have my hands on an usb keyboard
	to unlock the computer.

	There are 4 steps to enable unlocking the luks volume using a device.

	1. Create the key
	2. Add the key on the luks volume
	3. Write the key on the usb device
	4. Configure NixOS

	First step, creating the file. The easiest way is to the following:

	# dd if=/dev/urandom of=/root/key.bin bs=4096 count=1

	This will create a 4096 bytes key. You can choose the size you want.

	Second step is to register that key in the luks volume, you will
	be prompted for luks password when doing so.

	# cryptsetup luksAddKey /dev/sda1 /root/key.bin

	Then, it's time to write the key to your usb device, I assume it
	will be `/dev/sdb`.

	# dd if=/root/key.bin of=/dev/sdb bs=4096 count=1

	And finally, you will need to configure NixOS to give the information
	about the key. It's important to give the correct size of the key.
	Don't forget to adapt `"crypted"` to your luks volume name.

	boot.initrd.luks.devices."crypted".keyFileSize = 4096;
	boot.initrd.luks.devices."crypted".keyFile = "/dev/sdb";

	Rebuild your system with `nixos-rebuild switch` and voilà!


	### Going further

	I recommend using the fallback to password feature so if you
	lose or don't have your memory stick, you can type the password to
	unlock the disk. Note that you need to not put anything looking
	like a `/dev/sdb` because if it exists and no key are there, the
	system won't ask for password, and you will need to reboot.

	boot.initrd.luks.devices."crypted".fallbackToPassword = true;

	It's also possible to write the key in a partition or at a specific
	offset into your memory disk. For this, look at
	`boot.initrd.luks.devices."volume".keyFileOffset` entry.