lnorg/documentation
1
2
Fork 0
Code Issues 30 Pull requests Projects 6 Activity

docs/alpine-server-setup/provisioning.md: change tank to rpool and update w.r.t. zlevis 2.0

Browse source
This commit is contained in:
Luc Bijl 2025-02-21 23:21:19 +01:00
parent 0f62c92746
commit e6434602c8
1 changed files with 17 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
docs/alpine-server-setup/provisioning.md
View file

@ -16,9 +16,11 @@ To set it up `setup-interfaces` and `setup-apkrepos` will be used.
A few packages will have to be installed first, A few packages will have to be installed first,
``` ```
# apk add zfs lsblk sgdisk wipefs dosfstools acpid mdadm tpm2-tools zlevis # apk add zfs lsblk sgdisk wipefs dosfstools acpid mdadm zlevis
``` ```
> The `zlevis` package is as of this moment not yet in the alpine package repository. Try to get it into the `/usr/bin` directory via a different method and add its dependencies `tpm2-tools` and `jose`.
and load the ZFS kernel module and load the ZFS kernel module
``` ```
@ -96,13 +98,13 @@ Define the pool partitions
> done > done
``` ```
The ZFS system pool is going to be encrypted. First generate an encryption key and save it temporarily to the file `/tmp/tank.key` with: The ZFS system pool is going to be encrypted. First generate an encryption key and save it temporarily to the file `/tmp/rpool.key` with:
``` ```
# cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1 > /tmp/tank.key && cat /tmp/tank.key # cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1 > /tmp/rpool.key && cat /tmp/rpool.key
``` ```
> Later on in the guide `zlevis` will be used for automatic decryption, so this key only has to be entered a few times. However, if any changes are made to the bios or secureboot then this key will be needed again, so make sure to save it. > While `zlevis` will be used for automatic decryption, if any changes are made to the bios or secureboot then this key will be needed, so make sure to save it.
Create the system pool: Create the system pool:
@ -117,7 +119,7 @@ Create the system pool:
-O keyformat=passphrase \ -O keyformat=passphrase \
-O keylocation=prompt \ -O keylocation=prompt \
-m none \ -m none \
tank raidz1 $poolparts rpool raidz1 $poolparts
``` ```
> Additionally, the `spare` option can be used to indicate spare disks. If more redundancy is preferred than `raidz2` and `raidz3` are possible [alternatives](https://openzfs.github.io/openzfs-docs/man/master/7/zpoolconcepts.7.html) for `raidz1`. If a single disk is used the `raidz` option can be left aside. For further information see [zpool-create](https://openzfs.github.io/openzfs-docs/man/master/8/zpool-create.8.html). > Additionally, the `spare` option can be used to indicate spare disks. If more redundancy is preferred than `raidz2` and `raidz3` are possible [alternatives](https://openzfs.github.io/openzfs-docs/man/master/7/zpoolconcepts.7.html) for `raidz1`. If a single disk is used the `raidz` option can be left aside. For further information see [zpool-create](https://openzfs.github.io/openzfs-docs/man/master/8/zpool-create.8.html).
@ -125,24 +127,26 @@ Create the system pool:
Then create the system datasets: Then create the system datasets:
``` ```
# zfs create -o mountpoint=none tank/root # zfs create -o mountpoint=none rpool/root
# zfs create -o mountpoint=legacy -o quota=24g tank/root/alpine # zfs create -o mountpoint=legacy -o quota=24g rpool/root/alpine
# zfs create -o mountpoint=/home -o atime=off -o setuid=off -o devices=off -o quota=<home-quota> tank/home # zfs create -o mountpoint=/home -o atime=off -o setuid=off -o devices=off -o quota=<home-quota> rpool/home
# zfs create -o mountpoint=/var -o atime=off -o exec=off -o setuid=off -o devices=off -o quota=16g tank/var # zfs create -o mountpoint=/var -o atime=off -o exec=off -o setuid=off -o devices=off -o quota=16g rpool/var
``` ```
> Setting the `<home-quota>` depends on the total size of the pool, generally try to reserve some empty space in the pool. > Setting the `<home-quota>` depends on the total size of the pool, generally try to reserve some empty space in the pool.
Write the encryption key to TPM and store the jwe in tpm:jwe: Write the encryption key to TPM with `zlevis`:
``` ```
# zfs set tpm:jwe=$(zlevis-encrypt '{}' < /tmp/tank.key) tank # zlevis encrypt rpool '{}' < /tmp/rpool.key
``` ```
> To check if it worked, perform `zfs list -Ho tpm:jwe tank | zlevis-decrypt`. > We are using the default configuration settings for `zlevis encrypt` but a different configuration is possible by setting `'{}'` accordingly.
> To check if it worked, perform `zlevis decrypt rpool`.
Finally, export the zpool: Finally, export the zpool:
``` ```
# zpool export tank # zpool export rpool
``` ```