Unlock initrd cryptsetup during reboot

[mweinelt]

It would be cool to be able to extend colmena with remote luks unlock via initrd SSH support. Then in the cycle of colmena apply hive.nix boot --reboot we would not need external interaction to unlock the host.

The script, that I currently rely on, boils down to:

echo "secret" | ssh root@unlock.this.example-host.com cryptsetup-askpass

[fooker]

Idea on how this could look like:

{ node-a.deployment.hooks = {
    post-reboot = ./path/to/script;
    post-activation = pkgs.writeShellScript "post-activation" ''
       # ...
    ''
}}

This implies that this can be either a path or a derivation which is build using meta.nixpkgs.

Also, would be awesome to have access to the deployment data like IPs and such inside these scripts.