HOWTO: Unlock LUKS encrypted disks over SSH on a Raspberry Pi 4 running NixOS

Follow the instructions on the NixOS wiki. For a Raspberry Pi 4 connected over Ethernet, you need:

boot.initrd.availableKernelModules = [
  "xhci_pci"
  "usbhid"
  "uas"
  "pcie-brcmstb"
  "reset-raspberrypi"
  "genet"
  "broadcom"
  "bcm_phy_lib"
];

Also note: use cipher xchacha20,aes-adiantum-plain64 on Raspberry Pi 4 due to the lack of AES hardware instructions. The default aes-xts-plain64 is slow without these instructions; xchacha20,aes-adiantum-plain64 is over twice as fast. (Raspberry Pi 5 has AES instructions, but doesn’t support NixOS very well yet.) If you forget to set the cipher when creating the encrypted device, cryptsetup reencrypt can help, but it may take multiple days once you have any real amount of data on the disk at all.