change script to first import storage before unlocking root

machines/fanny/configuration.nix

@@ -86,15 +86,10 @@ in
     enable = true;
     authorizedKeys = sshKeys.admins;
     ethernetDrivers = ["r8169"];
-    zfsExtraPools = [ "storage" ];
   };
 
   boot.initrd = {
     availableKernelModules = [ "wireguard" ];
-    # postMountCommands = ''
-    #   ip address flush dev wg-initrd
-    #   ip link set dev wg-initrd down
-    # '';
     systemd = {
       enable = true;
       network = {
@@ -106,15 +101,15 @@ in
           };
           wireguardConfig = { PrivateKeyFile = "/etc/secrets/30-wg-initrd.key"; };
           wireguardPeers = [{
-            AllowedIPs = peers.vpn.allowedIPs;
-            PublicKey = peers.vpn.publicKey;
+            AllowedIPs = peers.fanny-initrd.allowedIPs;
+            PublicKey = peers.fanny-initrd.publicKey;
             Endpoint = "${peers.vpn.publicIp}:${builtins.toString(peers.vpn.listenPort)}";
             PersistentKeepalive = 25;
           }];
         };
         networks."30-wg-initrd" = {
           name = "wg-initrd";
-          addresses = [{ Address = "${peers.fanny-initrd.address}/24"; }];
+          addresses = [{ Address = peers.fanny-initrd.address; }];
         };
       };
     };

machines/modules/malobeo/initssh.nix

@@ -22,11 +22,6 @@ in
       description = "Ethernet drivers to load: run `lspci -k | grep -iA4 ethernet`";
       example = "r8169";
     };
-    zfsExtraPools = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "Name or GUID of extra ZFS pools that you wish to import during boot.";
-    };
   };
   
   config = lib.mkIf (cfg.enable && config.malobeo.disks.encryption) {
@@ -37,41 +32,33 @@ in
       zfs = {
         forceImportAll = true;
         requestEncryptionCredentials = true;
-        extraPools = cfg.zfsExtraPools;
+        
       };
       initrd = {
         availableKernelModules = cfg.ethernetDrivers;
         systemd = {
-          initrdBin = [ pkgs.busybox pkgs.wireguard-tools pkgs.iproute2 ]; 
           enable = true;
           network.enable = true;
-          services."stopInitVpn" = {
-            description = "stop init vpn";
-            wantedBy = [
-              "initrd.target"
-            ];
-            after = [
-              "zfs.target"
-            ];
-            serviceConfig.StandardOutput = "journal+console";
-            script = ''
-              networkctl down wg-initrd
-            '';
-            serviceConfig.Type = "oneshot";
-      };
         };
-        network = {
-          flushBeforeStage2 = true;
-          ssh = {
-            enable = true;
-            port = 222;
-            authorizedKeys = cfg.authorizedKeys;
-            hostKeys = [ "/etc/ssh/initrd" ];
-          };
+        network.ssh = {
+          enable = true;
+          port = 222;
+          authorizedKeys = cfg.authorizedKeys;
+          hostKeys = [ "/etc/ssh/initrd" ];
         };
         secrets = {
           "/etc/ssh/initrd" = "/etc/ssh/initrd";
         };
+        systemd.services.zfs-remote-unlock = {
+          description = "Prepare for ZFS remote unlock";
+          wantedBy = ["initrd.target"];
+          after = ["systemd-networkd.service"];
+          path = with pkgs; [ zfs ];
+          serviceConfig.Type = "oneshot";
+          script = ''
+            echo "zfs load-key -a; killall zfs; systemctl default" >> /var/empty/.profile
+          '';
+        };
       };
       kernelParams = [ "ip=::::${hostName}-initrd::dhcp" ];
     };