--vm-test is not supported with --disk-encryption-keys

[tobiasBora]

For now, it is impossible to test a vm with the option --disk-encryption-keys, which is very sad as it is precisely the setting I'd like to test:

$ nixos-anywhere --flake .#myconfig --disk-encryption-keys /boot/secret.key <(echo -n "foo") --vm-test
--vm-test is not supported with --disk-encryption-keys

Would it be possible to fix this?

[sedlund]

Check out https://github.com/nix-community/disko/blob/master/docs/disko-images.md

[Mic92]

One workaround could be to provide fake disk encryption keys i.e. by detecting if the qemu-vm.nix options are present.

[tobiasBora]

@sedlund Thanks you for the tip, I,ll give it a try! Though it would be nicer to directly provide a nixos-anywhere-native way to make it work as it is significantly more straightforward.

@Mic92 Out of curiosity, where is the difficulty here with --vm-test and --disk-encryption-keys? Is it because the image is produced by nix flake before even reading the --diks-encryption-keys, and therefore can't add any file later in the process as the nix store is write-only? If so, I can maybe think of a few ideas:

• Why can't we ssh/… (or whichever system nixos-anywhere is using) to the VM before running nixos-anywhere and copy the file there?
• Or generate another derivation that basically links all files in the flake and additionally adds the needed secret files.
• Or one could also create an option like nixos-anywhere.vmtest-disk-encryption-keys = {"/boot/secret.key": "dummy password";} that would only be read when building an image.

[Mic92]

VM tests run inside a nixos VM test inside a nix build. So no easy way to inject keys through files or the network.