Change:
Describe the bug I have a ZFS pool with approximately the following layout: The datasets under are those that the local system is installed on and the datasets under are backups from a different machine received via . All datasets are using native ZFS encryption, however, datasets under are encrypted with a different key (that of the machine that sent the backups) than the rest of the pool. When I boot, the initrd will query me for the key for and but this key is not available and I also don't want to make it available for obvious reasons. The culprit lies in this statement in the : This forces loading of all keys, which is a good default, but cannot easily be overridden. My current workaround for this is to turn this off and only load the key for manually. To this end I would like to propose the following patch by which it should be possible to load the key only for the specified datasets. To Reproduce Steps to reproduce the behavior: NixOS with an encrypted ZFS pool a dataset with a different encryption key and set you lost the key for this new dataset errors when mounting due to the lack of keys Expected behavior It should be possible to restrict for which pools and datasets to query encryption credentials. Screenshots N/A Additional context N/A Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Metadata system: host os: multi-user?: sandbox: version: nixpkgs: Maintainer information:
I think you can open a PR with your patch for this one.

Discussion:
}; requestEncryptionCredentials = mkOption { <del> type = types.bool; </del> <ins> type = types.either types.bool (types.listOf types.str); </ins> default = true; <ins> example = [ "tank" "data" ]; </ins> description = '' <del> Request encryption keys or passwords for all encrypted datasets on import. For root pools the encryption key can be supplied via both an interactive prompt (keylocation=prompt) and from a file (keylocation=file://). </del> <ins> If true on import encryption keys or passwords for all encrypted datasets are requested. To only decrypt selected datasets supply a list of dataset names instead. For root pools the encryption key can be supplied via both an interactive prompt (keylocation=prompt) and from a file (keylocation=file://). </ins> ''; };

fi poolImported "${pool}" || poolImport "${pool}"  # Try one last time, e.g. to import a degraded pool. fi <del> ${lib.optionalString cfgZfs.requestEncryptionCredentials '' zfs load-key -a ''} </del> <ins> ${if isBool cfgZfs.requestEncryptionCredentials then optionalString cfgZfs.requestEncryptionCredentials '' zfs load-key -a '' else concatMapStrings (fs: '' zfs load-key ${fs} '') cfgZfs.requestEncryptionCredentials} </ins> '') rootPools)); };

done poolImported "${pool}" || poolImport "${pool}"  # Try one last time, e.g. to import a degraded pool. if poolImported "${pool}"; then <del> ${optionalString cfgZfs.requestEncryptionCredentials '' </del> <ins> ${optionalString (if isBool cfgZfs.requestEncryptionCredentials then cfgZfs.requestEncryptionCredentials else cfgZfs.requestEncryptionCredentials != []) '' </ins> ${packages.zfsUser}/sbin/zfs list -rHo name,keylocation ${pool} | while IFS=$'t' read ds kl; do <del> (case "$kl" in </del> <ins> (${optionalString (!isBool cfgZfs.requestEncryptionCredentials) '' if ! echo '${concatStringsSep "n" cfgZfs.requestEncryptionCredentials}' | grep -qFx "$ds"; then continue fi ''} case "$kl" in </ins> none ) ;; prompt )