nixos-crypt-root-onepass.sh

$ cryptsetup luksDump /dev/nvme0n1p1
(only one slot used)
$ dd if=/dev/urandom of=./keyfile.bin bs=1024 count=4
$ cryptsetup luksAddKey /dev/nvme0n1p1 ./keyfile.bin
(two slots used, 0 for passphrase, 1 for keyfile)
$ cryptsetup luksDump /dev/nvme0n1p1
$ sudo su - 
# echo ./keyfile.bin | cpio -o -H newc -R +0:+0 --reproducible | gzip -9 > /boot/initrd.keys.gz

## Edit configuration.nix

 boot.loader.grub = {                                                                                             
    ...                                                                               
   extraInitrd = "/boot/initrd.keys.gz";                                                                          
   ...                                                                            
 };         
 
  boot.loader.grub = {                                                                                                                                     
    enable = true;                                                                                                                                         
    version = 2;                                                                                                                                           
    enableCryptodisk = true;                                                                                                                               
    extraInitrd = "/boot/initrd.keys.gz";                                                                                                                  
    device = "/dev/nvme0n1";                                                                                                                               
  };   
 
  boot.initrd.luks = {                                                                                                                                     
    devices = [ {                                                                                                                                          
      name = "root";                                                                                                                                       
      preLVM = true;                                                                                                                                       
      keyFile = "/keyfile.bin";                                                                                                                            
      device = "/dev/nvme0n1p1";                                                                                                                           
    } ];                                                                                                                                                   
  };