Use systemd mounts instead of handwritten script

hosts/nixos/lapetus/filesystems/zfs.nix

@@ -1,74 +1,28 @@
-{ config, pkgs, ... }: {
+{ config, pkgs, ... }:
+let secretMountpoint = "/hermes";
+in
+{
   # Configure ZFS
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.extraPools = [ "zroot" ];
   boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
   boot.kernelParams = [ "nohibernate" ];
 
-  boot.initrd.systemd.services =
+  # {{{ Mount usb for zfs secrets
-    let secretMountpoint = "/hermes";
+  boot.initrd.systemd.systemd.mounts.hermes = {
-    in
+    where = "/hermes";
-    {
+    what = "/dev/sdb";
-      # {{{ Mount usb 
+    type = "exfat";
-      mountSecrets = {
+
-        serviceConfig = {
+    # The usb contains sensitive data that should only be readable to root
-          Type = "oneshot";
+    mountConfig.DirectoryMode = "0750";
-          RemainAfterExit = true;
+
-        };
-        unitConfig.DefaultDependencies = "no";
     wantedBy = [ "zfs-import.target" ];
     before = [ "zfs-import.target" ];
-        script = ''
-          MOUNTPOINT="${secretMountpoint}"
-          USB="/dev/sdb"
-
-          echo "Waiting for $USB"
-          for I in {1..20}; do
-              if [ -e "$USB" ]; then break; fi
-              echo -n .
-              sleep 1
-          done
-
-          echo "Found $USB"
-          sleep 1
-
-          if [ -e "$USB" ]; then
-              echo "Mounting $USB"
-              mkdir -p $MOUNTPOINT
-              mount -o ro "$USB" $MOUNTPOINT
-              if [ $? -eq 0 ]; then
-                  exit 0
-              else
-                  echo "Error mounting $USB" >&2
-              fi
-          else
-              echo "Cannot find $USB" >&2
-          fi
-        '';
-      };
-      # }}}
-      # {{{ Unmount usb 
-      unmountSecrets = {
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-        };
-        unitConfig.DefaultDependencies = "no";
-        wantedBy = [ "initrd.target" ];
-        after = [ "zfs-mount.service" ];
-        script = ''
-          MOUNTPOINT="${secretMountpoint}"
-          if [ -e "$MOUNTPOINT" ]; then
-              echo "Clearing $MOUNTPOINT"
-              umount $MOUNTPOINT
-              rmdir $MOUNTPOINT
-              echo "Unmounted $MOUNTPOINT"
-          else
-              echo "Nothing to unmount"
-          fi
-        '';
   };
   # }}}
+
+  boot.initrd.systemd.services = {
     # # {{{ Rollback 
     # rollback = {
     #   path = [ pkgs.zfs ];