unlock.nix

{
  systemd.services."unlock-backup-disks" = {
    description = "Unlock the LUKS encrypted ZFS backup disks";
    unitConfig = {
      DefaultDependencies = "no";
    };
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    script = ''
      if [[ ! -e /dev/mapper/luks ]]; then
        ${pkgs.cryptsetup}/bin/cryptsetup luksOpen /dev/disk/by-uuid/${cfg.luks} luks --key-file=/wheel/arc/${config.host.name}-luks.key
      fi
      ${pkgs.zfs}/bin/zpool import -a
    '';
    after = [ "systemd-udev-settle.service" "systemd-modules-load.service" ];
    requires = [ "systemd-udev-settle.service" ];
    before = [ "local-fs.target" "zfs-import.target" ];
    wantedBy = [ "local-fs.target" ];
    requiredBy = [ "zfs-import.target" ];
    restartIfChanged = false;
  };
}