l hilum.r: pass luks passphrase in flash script

lass/1systems/hilum/disk.nix

@@ -1,4 +1,4 @@
-{ lib, disk, ... }:
+{ lib, disk, keyFile, ... }:
 {
   disk = {
     main = {
@@ -37,7 +37,7 @@
             content = {
               type = "luks";
               name = "hilum_luks";
-              # keyFile = "/tmp/secret.key";
+              keyFile = keyFile;
               content = {
                 type = "filesystem";
                 format = "xfs";

lass/1systems/hilum/flash-stick.sh

@@ -4,14 +4,24 @@ set -efux
 disk=$1
 
 export NIXPKGS_ALLOW_UNFREE=1
+(umask 077; pass show admin/hilum/luks > /tmp/hilum.luks)
+trap 'rm -f /tmp/hilum.luks' EXIT
 stockholm_root=$(git rev-parse --show-toplevel)
 ssh root@localhost -t -- $(nix-build \
   --no-out-link \
   -I nixpkgs=/var/src/nixpkgs \
   -I stockholm="$stockholm_root" \
   -I secrets="$stockholm_root"/lass/2configs/tests/dummy-secrets \
-  -E "with import <nixpkgs> {}; (pkgs.nixos [ { mainDisk = \"$disk\"; disko.rootMountPoint = \"/mnt/hilum\"; } ./physical.nix ]).mountScript"
+  -E "with import <nixpkgs> {}; (pkgs.nixos [
+    {
+      luksPassFile = \"/tmp/hilum.luks\";
+      mainDisk = \"$disk\";
+      disko.rootMountPoint = \"/mnt/hilum\";
+    }
+    ./physical.nix
+  ]).disko"
 )
+rm -f /tmp/hilum.luks
 $(nix-build \
   --no-out-link \
   -I nixpkgs=/var/src/nixpkgs \
@@ -21,7 +31,7 @@ $(nix-build \
   --arg force true
 )
 ssh root@localhost << SSH
-nixos-install --no-root-password --root /mnt/hilum -I /var/src
+NIXOS_CONFIG=/mnt/hilum/var/src/nixos-config nixos-install --no-root-password --root /mnt/hilum -I /var/src
 nixos-enter --root /mnt/hilum -- nixos-rebuild -I /var/src switch --install-bootloader
 umount -Rv /mnt/hilum
 SSH

lass/1systems/hilum/physical.nix

@@ -12,11 +12,18 @@
       };
       config.environment.etc.hilum-disk.text = config.mainDisk;
     }
+    {
+      options.luksPassFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
+    }
   ];
 
   disko.devices = import ./disk.nix {
     inherit lib;
     disk = config.mainDisk;
+    keyFile = config.luksPassFile;
   };
 
   boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];