
<feed xmlns="http://www.w3.org/2005/Atom">
    <generator>Hugo -- gohugo.io</generator>
    <title>
                encryption on
            
        
        The Neo-Babbage Files</title>
        <link href="https://babbagefiles.xyz/tags/encryption/atom.xml" rel="self" type="application/atom+xml" /><link href="https://babbagefiles.xyz/tags/encryption/"/>
    <updated>2025-12-29T11:00:32+00:00</updated>
    <author>
            <name>Benjamin Slade</name>
            
                <email>slade@lambda-y.net</email>
            </author>
    <id>https://babbagefiles.xyz/tags/encryption/</id>
        
        <entry>
            <title type="html"><![CDATA[Semi-automated installation of Void Linux on pure ZFS with full LUKS disk encryption]]></title>
            <link href="https://babbagefiles.xyz/full-zfs-full-luks-on-void-linux/"/>
            <id>https://babbagefiles.xyz/full-zfs-full-luks-on-void-linux/</id>
            
                    <author>
                        <name>Benjamin Slade</name>
                    </author>
            <published>2019-06-17T15:53:01-06:00</published>
            <updated>2019-06-17T16:23:39-06:00</updated>
            
            
            <content type="html"><![CDATA[<p>After spending too much time repeatedly trying to set up a Void Linux
installation using &lsquo;pure ZFS&rsquo; and full-disk LUKS encryption, I ended
up writing up a set of BASH scripts to automate (and, effectively,
document) the installation process, and prevent me from forgetting
steps along the way. There&rsquo;s quite a number of potential stumbling
block along the way (such as <code>grub-probe</code> not knowing how to properly
find the root drive) which I figured out ways around, as well as
discovering that Void&rsquo;s <code>zfs-0.8.0</code> package was
<a href="https://github.com/void-linux/void-packages/issues/12465">missing a
<code>python3</code> dependency which caused ZFS DKMS builds to fail</a>.</p>



<figure>
    
        
            <img src="https://gitlab.com/emacsomancer/full-zfs-and-full-luks-encryption-on-void-linux/raw/master/misc/void-on-zfs.png" alt="Void Linux on ZFS" width="300"/> </figure>

<p>The scripts are more or less automated if you&rsquo;re installing in a
particular fashion. They&rsquo;ll ask for user input along the way for
configuring/customising certain things.  What isn&rsquo;t covered is a setup
with multiple vdevs or UEFI or musl, but if you want these things
you&rsquo;ll probably be able to patch the scripts accordingly and perhaps
these options could be accommodated in a future version.</p>
<p>The scripts live here:
<a href="https://gitlab.com/emacsomancer/full-zfs-and-full-luks-encryption-on-void-linux">https://gitlab.com/emacsomancer/full-zfs-and-full-luks-encryption-on-void-linux</a>
, where you&rsquo;ll find additional instructions and information.</p>
<p>(I do recommend using the <a href="https://ubuntu.com/download/desktop">Ubuntu Live ISO</a> as your installer &lsquo;host&rsquo; for
ease and reduction of the installation time: the &lsquo;host&rsquo; for the
installation doesn&rsquo;t really matter: basically it&rsquo;s just being used to
run the initial <code>cryptsetup</code> for the LUKS partition and initial ZFS
pool creation and the host for the Void chroot. The Ubuntu Live CD has
ZFS baked in, so you don&rsquo;t have to wait twice(!) for DKMS to build ZFS
modules.)</p>
<p>Using ZFS for the entire system, from <code>/</code> to <code>/home</code> to <code>/boot</code> also
has the advantage of not requiring you to decide how much space to
allocation ahead of time. With <code>/boot</code> on a separate partition, I&rsquo;ve
sometimes encountered issues of running out of space on <code>/boot</code>
because of maintaining multiple kernels, or else having to massively
overshoot in terms of how much space to give to <code>/boot</code>. A full ZFS
install avoids this issue, <strong>and</strong> allows for easy snapshots of the
<code>/boot</code> directory.</p>
<p>ZFS is a great file-system if you care about your data. ZFS is most
impressive file-system, and it has a number of other wonderful
features aside from data-integrity, and once you&rsquo;re used to it, you&rsquo;ll
want it everywhere.  For instance, the &lsquo;default&rsquo; lz4 compression is
effectively &lsquo;free&rsquo;, in terms of CPU usage (minor CPU hit for dealing
with compression is offset by the need to process smaller chunks of
data), and can be significant: on my root dataset
(<code>dozer/ROOT/system</code>) I&rsquo;m currently getting 1.79x compression: so 22.7G
of logical data is written in 13.6G, and even my dataset full of PDFs
has a more modest 1.03x compression ratio, but this means I save over
3G.</p>
<p>ZFS 0.8.0 also brings with it native encryption. I&rsquo;ve not chosen to
use this at the moment, as LUKS makes a full-disk setup easier at
this point, but native encryption could be used in conjunction with
LUKS encryption (potentially useful if, say, you want to backup up
particular ZFS datasets to a remote and not entirely trusted
machine:– natively encrypted ZFS snapshots can be sent without
decrypting the data).</p>
<p>All of these various features, such as compression and encryption can
be enabled per dataset, which allows for great flexibility. After
suffering bit rot, which filtered through and rendered pointless my
carefully maintained versioned backups, I really don&rsquo;t like trusting
my data to any other file-system.</p>
]]></content>
            
                 
                    
                         
                        
                            
                             
                                <category scheme="https://babbagefiles.xyz/categories/zfs" term="zfs" label="zfs" />
                             
                                <category scheme="https://babbagefiles.xyz/categories/linux" term="linux" label="linux" />
                             
                                <category scheme="https://babbagefiles.xyz/categories/automation" term="automation" label="automation" />
                            
                        
                    
                 
                    
                 
                    
                         
                        
                            
                             
                                <category scheme="https://babbagefiles.xyz/tags/encryption" term="encryption" label="encryption" />
                             
                                <category scheme="https://babbagefiles.xyz/tags/luks" term="luks" label="luks" />
                            
                        
                    
                
            
        </entry>
    
</feed>
