luks encryption manual on homepage not correct

[pandalec]

Hey! I am currently trying to install NixOS on an encrypted SSD and I use the manual on the homepage: https://nixos.org/nixos/manual/#sec-luks-file-systems

Problem is that if I follow the instructions on the homepage it won't work. Steps to produce:

1. Create Partitions with parted (in this case /dev/sda3)
2. Get UUID with blkid | grep sda3
3. cryptsetup luksFormat /dev/disk/by-uuid/<UUID>
4. YES and enter password twice
5. Now, UUID is missing and cryptsetup luksOpen <UUID> crypted wont work, ls -al /dev/disk/by-uuid/ shows only swap and fat partitions

Using /dev/disk/by-partuuid/ instead of /dev/disk/by-uuid/ would work

[stale[bot]]

I marked this as stale due to inactivity. → More info

[LucaFulchir]

I just hit this problem too, on unstable, rasperrypi4

I tried with:

            device="/dev/disk/by-uuid/<MY_UUID>";

            device="/dev/disk/by-label/CRYPT0";

turns out that for me it only works with:

            device="UUID=<MY_UUID>";

I got that format from here: https://github.com/NixOS/nixpkgs/blob/8eece9104370f5397b8d2e2a15129b77146589bb/nixos/modules/system/boot/luksroot.nix#L20-L21
But I don't understand why it was not working for me. Maybe the doc could be updated to include different supported formats though

[stale[bot]]

I marked this as stale due to inactivity. → More info

[bluesquall]

Recreated this problem today while I was reconfiguring a Surface Go.

It looks like cryptsetup luksFormat … has a side-effect of removing the endpoints under /dev/disk/by-uuid/ and /dev/disk/by-label/. As @parsifallo noted, the partuuid endpoint remains, so that is one workaround. At least on my machine, the partlabel endpoint also persists after luksFormat, and that’s the one I tend to operate with, especially when I want something repeatable for automation (e.g., the preinstall script in my NixOS config & dotfiles repo).

I’ll circle back after I finish reconfiguring this machine to see about a PR to update the docs.