From 840474435272a8e2648371df3517d82ad2c789f2 Mon Sep 17 00:00:00 2001
From: WilliButz <willibutz@posteo.de>
Date: Tue, 17 Dec 2024 10:20:14 +0100
Subject: [PATCH 1/2] nixos/repart-verity-store: set supportedFilesystems, drop
 fileSystems entry from test

The `/usr` entry in `fileSystems` is superfluous and currently
interferes with the systemd generator. Dropping the `fileSystem` entry
requires making the appropriate module explicitly available in initrd.
---
 nixos/modules/image/repart-verity-store.nix         | 8 +++++++-
 nixos/tests/appliance-repart-image-verity-store.nix | 7 -------
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/image/repart-verity-store.nix b/nixos/modules/image/repart-verity-store.nix
index 953a5997c5fd..9e8a4b7f85ba 100644
--- a/nixos/modules/image/repart-verity-store.nix
+++ b/nixos/modules/image/repart-verity-store.nix
@@ -81,7 +81,13 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    boot.initrd.systemd.dmVerity.enable = true;
+    boot.initrd = {
+      systemd.dmVerity.enable = true;
+      supportedFilesystems = {
+        ${config.image.repart.partitions.${cfg.partitionIds.store}.repartConfig.Format} =
+          lib.mkDefault true;
+      };
+    };
 
     image.repart.partitions = {
       # dm-verity hash partition
diff --git a/nixos/tests/appliance-repart-image-verity-store.nix b/nixos/tests/appliance-repart-image-verity-store.nix
index 3834d0a468ab..ef0fda4f780d 100644
--- a/nixos/tests/appliance-repart-image-verity-store.nix
+++ b/nixos/tests/appliance-repart-image-verity-store.nix
@@ -29,13 +29,6 @@
           options = [ "mode=0755" ];
         };
 
-        "/usr" = {
-          device = "/dev/mapper/usr";
-          # explicitly mount it read-only otherwise systemd-remount-fs will fail
-          options = [ "ro" ];
-          fsType = config.image.repart.partitions.${partitionIds.store}.repartConfig.Format;
-        };
-
         # bind-mount the store
         "/nix/store" = {
           device = "/usr/nix/store";

From 685d9fe348f00e71584a27cc841b8058e6cbee3f Mon Sep 17 00:00:00 2001
From: WilliButz <willibutz@posteo.de>
Date: Tue, 17 Dec 2024 17:09:36 +0100
Subject: [PATCH 2/2] nixos/repart-verity-store: use mkDefault for partition
 types

This makes it a bit easier to switch between using the default usr
veritysetup generator or the nix-store veritysetup generator.
---
 nixos/modules/image/repart-verity-store.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/image/repart-verity-store.nix b/nixos/modules/image/repart-verity-store.nix
index 9e8a4b7f85ba..15d0ce88872f 100644
--- a/nixos/modules/image/repart-verity-store.nix
+++ b/nixos/modules/image/repart-verity-store.nix
@@ -92,7 +92,7 @@ in
     image.repart.partitions = {
       # dm-verity hash partition
       ${cfg.partitionIds.store-verity}.repartConfig = {
-        Type = partitionTypes.usr-verity;
+        Type = lib.mkDefault partitionTypes.usr-verity;
         Verity = "hash";
         VerityMatchKey = lib.mkDefault verityMatchKey;
         Label = lib.mkDefault "store-verity";
@@ -101,7 +101,7 @@ in
       ${cfg.partitionIds.store} = {
         storePaths = [ config.system.build.toplevel ];
         repartConfig = {
-          Type = partitionTypes.usr;
+          Type = lib.mkDefault partitionTypes.usr;
           Verity = "data";
           Format = lib.mkDefault "erofs";
           VerityMatchKey = lib.mkDefault verityMatchKey;