feat: add zfs-encrypted-key-on-luks-zvol.nix

[ncrmro]

This file creates root on ZFS where the dataset is encrypted by a key that lives on a LUKS encrypted zvol. Allowing multiple passwords/TPM to unlock.

The only problem with it right now is that when using nixos-anywhere to run the install it hangs until I run cryptsetup luksClose /dev/mapper/credstore, which to postCreateHook is supposed to do.

When I run this I get

[root@nixos:~]# cryptsetup luksClose /dev/mapper/credstore
Device /dev/zd0 does not exist or access denied.
Device /dev/zd0 does not exist or access denied.
Device /dev/zd0 does not exist or access denied.

[root@nixos:~]# 
Broadcast message from root@nixos (Sun 2025-07-20 16:48:34 UTC):

The system will reboot now!

I understand it may not fit an example here but I'd like to see if anyone has any ideas for the luksClose issue..

[almereyda]

This is interesting and exactly how Ubuntu does. I'd suggest to replicate the behaviour in an accompanying tests/zfs-encrypted-key-on-luks-zvol.nix file and work it from there.