```
systemd.services.open-secondary-luks-volume = {
  script = ''
    ${pkgs.cryptsetup}/bin/cryptsetup open /dev/disk/by-uuid/*foo* -d /path/to/keyfile
  '';
  Type = "oneshot";
};
```