anchor.diff:        ''}
       '';
   
  -    boot.initrd.preLVMCommands = commonFunctions + concatStrings (mapAttrsToList openCommand preLVM);
  -    boot.initrd.postDeviceCommands = commonFunctions + concatStrings (mapAttrsToList openCommand postLVM);
  +    boot.initrd.preFailCommands = postCommands;
  +    boot.initrd.preLVMCommands = commonFunctions + preCommands + concatStrings (mapAttrsToList openCommand preLVM) + postCommands;
  +    boot.initrd.postDeviceCommands = commonFunctions + preCommands + concatStrings (mapAttrsToList openCommand postLVM) + postCommands;
   
       environment.systemPackages = [ pkgs.cryptsetup ];
     };
  
positive.code:     # copy the cryptsetup binary and it's dependencies
      boot.initrd.extraUtilsCommands = ''
        copy_bin_and_libs ${pkgs.cryptsetup}/bin/cryptsetup
  
        cat > $out/bin/cryptsetup-askpass <<EOF
        #!$out/bin/sh -e
        if [ -e /.luksopen_args ]; then
          cryptsetup \$(cat /.luksopen_args)
          killall -q cryptsetup
        else
          echo "Passphrase is not requested now"
          exit 1
        fi
        EOF
        chmod +x $out/bin/cryptsetup-askpass
  
        ${optionalString luks.yubikeySupport ''
          copy_bin_and_libs ${pkgs.yubikey-personalization}/bin/ykchalresp
  
negative.code:     }
    '';
  
    preCommands = ''
      # A place to store crypto things
  
      # A ramfs is used here to ensure that the file used to update
      # the key slot with cryptsetup will never get swapped out.
      # Warning: Do NOT replace with tmpfs!
      mkdir -p /crypt-ramfs
      mount -t ramfs none /crypt-ramfs
    '';
  
    postCommands = ''
      umount /crypt-ramfs 2>/dev/null
    '';
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, fallbackToPassword, ... }: assert name' == name;
    let
      csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
      cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
    in ''
      # Wait for luksRoot (and optionally keyFile and/or header) to appear, e.g.
      # if on a USB drive.
      wait_target "device" ${device} || die "${device} is unavailable"
  