Change:
message = "boot.resumeDevice has to be an absolute path." + " Old "x:y" style is no longer supported."; } <ins> # TODO: remove when #85000 is fixed { assertion = !config.boot.loader.supportsInitrdSecrets -> all (source: builtins.isPath source || (builtins.isString source && hasPrefix source builtins.storeDir)) (attrValues config.boot.initrd.secrets); message = '' boot.loader.initrd.secrets values must be unquoted paths when using a bootloader that doesn't natively support initrd secrets, e.g.: boot.initrd.secrets = { "/etc/secret" = /path/to/secret; }; Note that this will result in all secrets being stored world-readable in the Nix store! ''; } </ins> ]; system.build =

Discussion:
Describe the bug Nixos changed from Dropbear to OpenSSH in the initrd. While doing so it requires new keys and new options were add. However following the instructions still fails to build. To Reproduce Steps to reproduce the behavior: first generated a key at and the following to the failed with this error: that file exists: I followed the instructions from the module file : So I created the /etc/secrets/initrd folder and run the two commands, which resulted in: then the following to my nix: and rebuild again. This time it failed: Expected behavior It should properly detect the file provided in the hostKeys. Metadata Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(hyper): channels(root): nixpkgs: Maintainer information:
I see an error in the code: But even fixing it to: won't make the error go away. Also the mismatch in the examples: vs. didn't fix the problem.
Thanks for the report, and sorry for the broken code; I'll take a look at this. Note that this code path is only triggered when you use a bootloader without native initrd secrets support (which also exposes your host keys to the global Nix store), so using systemd-boot would probably avoid it. This should definitely still work though, so I'll poke at it; the tests are meant to exercise this code path but I guess not well enough.
The ECDA key with Dropbear worked just fine. I fail to see how systemd-boot could be integrated into the initrd to provide early ssh access - which is needed to remote unlock encrypted zfs root.
I meant that the SSH host key copying code that is breaking triggers only when the bootloader you're using doesn't support initrd secrets natively in NixOS, which systemd-boot does but GRUB doesn't. I'm looking into fixing this, but I suspect setting without the quotes will function as a workaround; it will explicitly copy the host key to the store ahead of time, which matches the behaviour of the test.
So I commented out the hostKeys entries and tried to rebuild: Which ended up in:
Try .
You were right about the quotes. Using: and the above fix: made it build successfully.
can't reboot now because I'm in the middle of a resilver and then scrub process.

Okay, so there are two issues here: the typo and . The former is easy to resolve, but I'm not sure about the latter; there's basically nothing that can be done with a bare path only accessible by root inside a sandboxed Nix build. So I think this would probably require a rework of the initrd secrets implementation to fix properly, and in the meantime the best thing that could be done would be to give a more useful error message at NixOS evaluation time if you use a string path when initrd secrets support is disabled; I'll work on the latter. Edit: there's actually no typo; is set .
Thanks for your hard work. I'll give feedback about initrd ssh boot once resilver and scrub have completed.
Looks better now. Thanks :)
Could you explain, how to work around that problem? I think I am missing something. I am getting a similar error when trying to set up a new system on nixos-unstable on a remote server with when running I get Edit: I installed 20.03 first, then updated to unstable and was able to build it, placing a copy of the keys everywhere it complained about, eg I think now I get the issue somewhat, that secrets of every generation are recreated on each build
I use: and on non-EFI
This issue has been mentioned on NixOS Discourse. There might be relevant details there: