I like this - I don't have a need for it, but it looks like the right thing to do.

The only thing that concerns me is stuff that messes around with initrd without a test. Something basic would be fine as long as we are sure that enabling this doesn't break booting.

I'll have a look into writing a test and will add it as soon as it is ready.

Would it make sense to squash the two commits, as they both just add tests (and one commit consumes the other one)?

This is cool! I'm still a bit -1 on this though. While we don't have any formal criteria for inclusion/exclusion of features, I think this is a use case specific and rare enough that it will only be used by you and might be better off in your personal config than in nixpkgs.

I support this.

I think the usecase is not too niche.
Imagine the following usecase:
You want to run a homeserver with encrypted disks
Your ISP does not give you a public IP
Your homeserver reboots/looses power
You are currently not at home

Now you need a possibility to connect to the homeserver and unlock the disks.
Assuming you have another server which has a public IP address you can connect to it via VPN and use it as a jump server to enter the password

I'm also a big fan of this PR, sadly I couldn't test it because of general busyness. Codewise it looks good to me.

@Amarandus, can you get someone else to test it as well (again due it messing with the boot process) to make sure all is good? Maybe a post on https://discourse.nixos.org if you don't have anyone at hand to try it out?

Thank you for your contributions.
This has been automatically marked as stale because it has had no activity for 180 days.
If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.
Here are suggestions that might help resolve this more quickly:

1. Search for maintainers and people that previously touched the
   related code and @ mention them in a comment.
2. Ask on the NixOS Discourse. 3. Ask on the #nixos channel on
   irc.freenode.net.

So, I finally got time to update this PR and squashed the commits together.

• I removed most options as they were unnecessary (adding additional files like certificates should be possible with boot.initrd.secrets directly, as the internal-attribute was removed recently there. Alternatively, you can inline them into the configuration)
  • Besides enable, there is only the option configuration, which expects a file path as a string (similar to boot.initrd.network.ssh.hostKeys)
  • Configuration is now always handled by boot.initrd.secrets, so there is only one place which decides whether files get into the store or not (depends on the bootloader)
  • It is not expected anymore to add iproute /bin/ip to the config - it will be appended automatically
• The test now uses the python test infrastructure
  • First test: Checks whether booting with an invalid config breaks
  • Second test: Checks whether a valid configuration really works