Hello fellow Guix users,

I want to decrypt a LUKS-encrypted device from a keyfile that is stored in a USB drive upon boot. The goal of this setup is to have the USB drive act like a key, and the computer cannot be decrypted without it. The process goes something like this:

1. Insert USB drive containing keyfile.
2. Boot computer.
3. USB drive is automatically mounted.
4. LUKS volumes are decrypted using the keyfile from the USB.

The Guix manual mentions that this keyfile can be declared in luks-device-mapping as an argument called, #:key-file. However, it does not go into further detail on how to make this file available during boot:

Key file is not stored in the store and needs to be available at the given location at the time of the unlock attempt.

Does anyone have a working configuration? Or can at least point me in the right direction?

Any help would be greatly appreciated.