recover.sh

cryptsetup luksOpen /dev/nvme0n1p2 cryptkey
cryptsetup luksOpen --key-file=/dev/mapper/cryptkey /dev/nvme0n1p3 cryptswap
cryptsetup luksOpen --key-file=/dev/mapper/cryptkey /dev/nvme0n1p4 cryptroot
#+END_SRC

Then for a not fun bit, matching entries in =/dev/disk/by-uuid/= to
the partitions we want to mount where. Running ~ls -l
/dev/disk/by-uuid/~ shows which devices have which UUIDs. To determine
what =dm-1= and =dm2=, I ran ~ls -la /dev/mapper~:

| name                                   | symlink to  | note                |
|----------------------------------------+-------------+---------------------|
| =1234-5678=                            | =sda2=      | installer           |
| =1970-01-01-00-00-01-00=               | =sda1=      | installer           |
| =AAAA-AAAA=                            | =nvme0n1p1= | /boot               |
| =BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBBBBBB= | =nvme0n1p2= | encrypted cryptkey  |
| =CCCCCCCC-CCCC-CCCC-CCCC-CCCCCCCCCCCC= | =nvme0n1p3= | encrypted cryptswap |
| =DDDDDDDD-DDDD-DDDD-DDDD-DDDDDDDDDDDD= | =nvme0n1p4= | encrypted cryptroot |
| =EEEEEEEE-EEEE-EEEE-EEEE-EEEEEEEEEEEE= | =dm-1=      | decrypted cryptswap |
| =FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF= | =dm-2=      | decrypted cryptroot |

Note I do have a =dm-0= for =cryptkey=, but no UUID but we won't need
it. I substituted the actual hash with =A=s =B=s =C=s =D=s =E=s and
=F=s in order to make the mount commands easier.

#+BEGIN_SRC text
# Enable swap using the decrypted cryptswap:
$ swapon /dev/disk/by-uuid/EEEEEEEE-EEEE-EEEE-EEEE-EEEEEEEEEEEE

# Mount the decrypted cryptroot to /mnt
$ mount /dev/disk/by-uuid/FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF /mnt

# Setup and mount the boot partition
$ mkdir /mnt/boot
$ mount /dev/disk/by-uuid/AAAA-AAAA /mnt/boot
#+END_SRC