From e7dca1c3c6d79d03a24fae289114db8d813d1138 Mon Sep 17 00:00:00 2001
From: Elliot Berman <eberman@anduril.com>
Date: Sun, 7 Dec 2025 12:49:24 -0800
Subject: [PATCH 1/2] nixos/luksroot: Remove explicit cryptd from
 boot.initrd.availableKernelModules

crytpd is a helper module which *may* be compiled based on architecture
and/or crypto algorithms which are supported (built) in the kernel.
Since not all kernels need cryptd to do LUKS-based encryption, move
cryptd to cryptoModules which can be configured based on the built
kernel.
---
 nixos/modules/system/boot/luksroot.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index e611d9040f8b..024dd856ea6c 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -647,6 +647,7 @@ in
         "sha512"
         "af_alg"
         "algif_skcipher"
+        "cryptd"
       ];
       description = ''
         A list of cryptographic kernel modules needed to decrypt the root device(s).
@@ -1135,7 +1136,6 @@ in
     boot.initrd.availableKernelModules = [
       "dm_mod"
       "dm_crypt"
-      "cryptd"
       "input_leds"
     ]
     ++ luks.cryptoModules

From 556701245cec7146b0d23a7b191987e159d432a5 Mon Sep 17 00:00:00 2001
From: Elliot Berman <eberman@anduril.com>
Date: Sun, 7 Dec 2025 13:53:35 -0800
Subject: [PATCH 2/2] nixos/luksroot: Move input_leds to
 boot.initrd.luks.cryptoModules

input_leds is commonly wanted, but not strictly needed, for luks. It
provides caps lock key LED functionlaity for most keyboards, which is
useful when inputing a password to unlock a LUKS filesystem.
---
 nixos/modules/system/boot/luksroot.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 024dd856ea6c..efc04ad75abc 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -648,6 +648,7 @@ in
         "af_alg"
         "algif_skcipher"
         "cryptd"
+        "input_leds" # for capslock LED on most keyboards in case decryption requires password
       ];
       description = ''
         A list of cryptographic kernel modules needed to decrypt the root device(s).
@@ -1136,7 +1137,6 @@ in
     boot.initrd.availableKernelModules = [
       "dm_mod"
       "dm_crypt"
-      "input_leds"
     ]
     ++ luks.cryptoModules
     # workaround until https://marc.info/?l=linux-crypto-vger&m=148783562211457&w=4 is merged