modules/ecryptfs.nix

{ pkgs, ... }: {
  environment.systemPackages = with pkgs; let
    unlock-database-script = writeScriptBin "unlock-database-encryption"
      ''
        if [ $UID -ne 0 ]; then
          echo "unlock-database-encryption must be run as root"
          exit 1
        fi
        ECRYPTFS_SIG=$(( stty -echo; printf "Passphrase: " 1>&2; read PASSWORD; stty echo; echo $PASSWORD; ) | ecryptfs-insert-wrapped-passphrase-into-keyring ~/.ecryptfs/wrapped-passphrase - | sed -nr 's/.*\[(.*)\].*/\1/p')

        keyctl link @u @s

        mount -i -t ecryptfs /var/db/.mongodb-encrypted/ /var/db/mongodb -o ecryptfs_sig=$ECRYPTFS_SIG,ecryptfs_fnek_sig=$ECRYPTFS_SIG,ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_unlink_sigs
      '';
  in
  [
    ecryptfs
    keyutils
    unlock-database-script
  ];
}