diff --git a/nixos/modules/image/repart-verity-store.nix b/nixos/modules/image/repart-verity-store.nix index 953a5997c5fd..15d0ce88872f 100644 --- a/nixos/modules/image/repart-verity-store.nix +++ b/nixos/modules/image/repart-verity-store.nix @@ -81,12 +81,18 @@ in }; config = lib.mkIf cfg.enable { - boot.initrd.systemd.dmVerity.enable = true; + boot.initrd = { + systemd.dmVerity.enable = true; + supportedFilesystems = { + ${config.image.repart.partitions.${cfg.partitionIds.store}.repartConfig.Format} = + lib.mkDefault true; + }; + }; image.repart.partitions = { # dm-verity hash partition ${cfg.partitionIds.store-verity}.repartConfig = { - Type = partitionTypes.usr-verity; + Type = lib.mkDefault partitionTypes.usr-verity; Verity = "hash"; VerityMatchKey = lib.mkDefault verityMatchKey; Label = lib.mkDefault "store-verity"; @@ -95,7 +101,7 @@ in ${cfg.partitionIds.store} = { storePaths = [ config.system.build.toplevel ]; repartConfig = { - Type = partitionTypes.usr; + Type = lib.mkDefault partitionTypes.usr; Verity = "data"; Format = lib.mkDefault "erofs"; VerityMatchKey = lib.mkDefault verityMatchKey; diff --git a/nixos/tests/appliance-repart-image-verity-store.nix b/nixos/tests/appliance-repart-image-verity-store.nix index 3834d0a468ab..ef0fda4f780d 100644 --- a/nixos/tests/appliance-repart-image-verity-store.nix +++ b/nixos/tests/appliance-repart-image-verity-store.nix @@ -29,13 +29,6 @@ options = [ "mode=0755" ]; }; - "/usr" = { - device = "/dev/mapper/usr"; - # explicitly mount it read-only otherwise systemd-remount-fs will fail - options = [ "ro" ]; - fsType = config.image.repart.partitions.${partitionIds.store}.repartConfig.Format; - }; - # bind-mount the store "/nix/store" = { device = "/usr/nix/store";