fixes

modules/nixos/boot/common/default.nix

@@ -1,35 +1,69 @@
 {
+  config,
   pkgs,
   system,
   lib,
+  namespace,
   ...
 }:
+with lib;
 let
+  inherit (lib.${namespace}) mkOpt mkBoolOpt;
+  cfg = config.${namespace}.boot.common;
   isArm = ("aarch64-linux" == system) || ("aarch64-darwin" == system);
 in
 {
-  boot = {
-    kernelParams = [
-      "quiet"
-    ];
+  options.${namespace}.boot.common = {
+    enable = mkBoolOpt true "Enable common boot stuff";
 
-    binfmt = lib.mkIf isArm {
-      registrations."x86_64-linux" = {
-        magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00'';
-        mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
-        openBinary = true;
-        interpreter = "${lib.getExe pkgs.box64}";
-        preserveArgvZero = true;
-        matchCredentials = true;
-        fixBinary = false;
+    yubikeyEncryption = mkBoolOpt false "Enable Yubikey root encryption";
+
+    yubikeyGracePeriod = mkOpt types.int 180 "Time to wait for yubikey in seconds";
+  };
+
+  config = mkIf cfg.enable {
+    boot = {
+      kernelParams = [
+        "quiet"
+      ];
+
+      binfmt = lib.mkIf isArm {
+        registrations."x86_64-linux" = {
+          magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00'';
+          mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+          openBinary = true;
+          interpreter = "${lib.getExe pkgs.box64}";
+          preserveArgvZero = true;
+          matchCredentials = true;
+          fixBinary = false;
+        };
+      };
+
+      supportedFilesystems = [ "bcachefs" ];
+
+      consoleLogLevel = lib.mkForce 3;
+      bootspec.enable = (!isArm);
+
+      initrd = {
+        luks = mkIf cfg.yubikeyEncryption {
+          devices = {
+            "${config.disko.devices.disk.main.content.partitions.root.name}" = {
+              yubikey = {
+                storage = {
+                  device = "/dev/disk/by-label/${config.disko.devices.disk.main.content.partitions.root.name}";
+                  fsType = config.${namespace}.hardware.disko.filesystem;
+                  path = "/";
+                };
+                slot = 2;
+                twoFactor = false;
+                gracePeriod = yubikeyGracePeriod;
+              };
+            };
+          };
+        };
       };
     };
 
-    supportedFilesystems = [ "bcachefs" ];
-
-    consoleLogLevel = lib.mkForce 3;
-    bootspec.enable = (!isArm);
+    zramSwap.enable = lib.mkDefault true;
   };
-
-  zramSwap.enable = lib.mkDefault true;
 }