Bcachefs unlock generator #345207
Bcachefs unlock generator #345207
Conversation
|
Also, the package depends on the crates |
e106ca6 to
c1f3ac6
Compare
|
Thanks for this, I just tested it on a native encrypted bcachefs 2 drive mirror and it works perfectly! So I can remove my hacky systemd units to unlock. I am still having issues with |
|
I don't really want to use this yet because it breaks Clevis. I'm not personally attached to Clevis specifically (though maybe someone is), but rather I want some mechanism to use TPM to provide the passphrase. A systemd credential could also work for that if the generator supported it. I suppose I could override the unit to add the credential and change the Do you have plans for automatic unlock? |
|
@mjm Yea, I'm debugging some issues with the generator on my test system, but my intention is to add the |
|
Awesome, once that's ready, I'll test it on my bcachefs machine. |
5c4012b to
07f0c3c
Compare
cd14cf3 to
d4df588
Compare
d4df588 to
9606f6b
Compare
9606f6b to
84073de
Compare
Description of changes
This systemd generator creates units that unlock your encrypted bcachefs file systems, based on the
fstabfile. It parses thefs_specfield and orders generated units after the necessary device.I need to write an installer test for this. The original repo has tests that prove it works but that needs to be migrated into here.
It also respects the
x-systemd.*FS options. e.g.x-systemd.requiresis used to order a multi-device bcachefs mount after the requisite devices.It also uses systemd credentials named
bcachefs$(systemd-escape $mountpoint).mount, so file systems can be unlocked via keyfile, potentially encrypted with the TPM2.Requesting review from known bcachefs users, among others.
Closes #317901
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.