@Mic92, thanks for your PR! By analyzing the history of the files in this pull request, we identified @wizeman, @Baughn and @fpletz to be potential reviewers.

For the mean-time, these are the commands, I used to get a bootable encrypted zfs:

zfs create -o encryption=aes-256-gcm -o keyformat=passphrase -o mountpoint=none zroot/root
zfs create -o mountpoint=legacy -o sync=disabled zroot/root/tmp
zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=true zroot/root/home
zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=true zroot/root/nixos
mount -t zfs zroot/root/nixos /mnt
mkdir /mnt/{home,tmp,boot}
mount /dev/sda1 /mnt/boot/
mount -t zfs zroot/root/home /mnt/home/
mount -t zfs zroot/root/tmp /mnt/tmp/
nixos-generate-config  --root /mnt
nixos-install

Also an article why you want fs-encryption over luks: https://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/

At least I added documentation here: https://nixos.wiki/wiki/NixOS_on_ZFS#Encrypted_ZFS

Does this mean at the moment, for my UEFI setup, I still need a separate EFI boot partition that contains everything needed to boot the encrypted ZFS? Is there any plans to integrate this into the NixOS configuration (as a module) before 18.03 is released.

Yes, there is no bootloader supporting zfs encryption to my knowledge, so an UEFI partition is required. No, I don't have any plans to backport this, because:

• There is still not stable zfs version supporting this version
• There is also an ongoing pull request for zfs, that will change the disk format: Encryption and Raw Send Stability Improvements openzfs/zfs#6864

@Mic92 just an fyi: that upstream PR was merged February 2: openzfs/zfs#6864 (comment) .

@davidblewett yes, we also put a migration guide on the wiki.

Are encrypted data sets supported now in 19.03? Trying to set this up on a fresh install and getting complaints from the zpool/zfs commands when I try setting the encryption option :(

As mentioned in the wiki zfs 0.8 aka zfsUnstable is required. How ever the installer comes with 0.7.13. You can update but the kernel module stays in that Version that does not feature encryption. Therefore the errors.

@jaykru it will work with nixos unstable or if you build your own zfs installer with zfsUnstable enabled: https://github.com/Mic92/dotfiles/blob/1606c820b82353dbf06884cac5a127e1f92479a5/nixos/images/install-iso.nix#L16
https://github.com/Mic92/dotfiles/blob/master/nixos/images/zfs.nix#L2