Bcachefs unlock generator

[ElvishJerricco]

Description of changes

This systemd generator creates units that unlock your encrypted bcachefs file systems, based on the fstab file. It parses the fs_spec field and orders generated units after the necessary device.

I need to write an installer test for this. The original repo has tests that prove it works but that needs to be migrated into here.

I also need to have it respect the x-systemd.* FS options. e.g. x-systemd.requires is used to order a multi-device bcachefs mount after the requisite devices.

Requesting review from known bcachefs users, among others.

Closes #317901

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[ElvishJerricco]

Also, the package depends on the crates fstab, libsystemd-sys, and systemd. This is largely unnecessary and I intend to remove these dependencies. They just made life easier during development. They should be removed before merging. Help is welcome.

[kraftnix]

Thanks for this, I just tested it on a native encrypted bcachefs 2 drive mirror and it works perfectly! So I can remove my hacky systemd units to unlock.

I am still having issues with systemd-remount-fs trying to unlock the bcachefs disk every rebuild and failing as it has no passphrase, but I had that previously (using a different hacky systemd unit to unlock and mount the bcachefs encrypted mirror).

[mjm]

I don't really want to use this yet because it breaks Clevis. I'm not personally attached to Clevis specifically (though maybe someone is), but rather I want some mechanism to use TPM to provide the passphrase. A systemd credential could also work for that if the generator supported it. I suppose I could override the unit to add the credential and change the ExecStart to use it, but that's a little more invasive than I'd like to be.

Do you have plans for automatic unlock?

[ElvishJerricco]

@mjm Yea, I'm debugging some issues with the generator on my test system, but my intention is to add the --credential option to the systemd-ask-password call so that it can work pretty seamlessly with the TPM.

[mjm]

Awesome, once that's ready, I'll test it on my bcachefs machine.