initrd-cryptsetup

# /etc/nixos/configuration.nix
boot = {
  initrd.network = {
    enable = true;
    ssh = {
      enable = true;
      port = 2222;
      hostECDSAKey = /etc/nixos/secrets/initrd-ssh-key;
    };
    postCommands = ''
      echo "cryptsetup luksOpen --tries 99 /dev/sda2 root && killall cryptsetup" >> /root/.profile

      ip addr add ${network.ipv6} dev eth0
      ip route add default via fe80::1 dev eth0
    '';
  };
};