shell.nix: Add luks remote unlock script

Closes #9.

shell.nix

@@ -25,6 +25,19 @@ let
       set -e
       $(nix-build --no-out-link deploy.nix -A "$1")
     '';
+
+    unlock = ''
+      set -eo pipefail
+      machine="$1"
+      hostname="$(nix-instantiate --eval --json machines -A "$1".target | ${pkgs.jq}/bin/jq -r . | cut -d@ -f2)"
+      ssh \
+          -oStrictHostKeyChecking=no \
+          -oGlobalKnownHostsFile=<(echo "[$hostname]:2222 ssh-ed25519 $(ssh-keygen -l -f <(ssh-keygen -y -f<(pass "nixos/machines/$machine/initrd-ssh-host-key")) | cut -d' ' -f2)") \
+          -4 \
+          -p 2222 \
+          "root@$hostname" \
+          "cat > /crypt-ramfs/passphrase" < <(pass "devices/$machine/luks")
+    '';
   };
 in
 pkgs.mkShell {