You are not logged in.

#1 2023-09-04 13:12:29

Registered: 2018-06-09
Posts: 64

Setup clevis with tang on systemd based initramfs

I've been trying to get clevis working with a server, so when the server reboots or boots up and it detects the tang server on my network it auto unlocks all the encrypted drives. The luks encrypted drives are set in the systemd-boot entry under options. I've been unlocking them at boot like this for a few years now:

title Arch Linux
sort-key archlinux-10
linux /installs/active/arch/vmlinuz-linux
initrd /installs/active/arch/amd-ucode.img
initrd /installs/active/arch/initramfs-linux.img
options root=UUID=95ed4d5b-e51d-46ad-b505-c9587446244e rootflags=subvol=_active/root-arch resume=UUID=9a7fa996-cfb6-4789-b3d3-ae0d602cdf05 rw

The tang server is curenty on a temporary raspberry pi and i have bind clevis to them with the following command

clevis luks bind -d /dev/sda2 tang '{"url": "http://ip-of-tang-server"}'

I've been following this guide but I found out that this solution sadly doesn't work with systemd based initramfs.

I'm using mkinitcpio-systemd-extras to get systemd-networkd working on early boot with the same static IP the system has when it's running normaly. My current mkinitcpio hooks are as follows:

HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-network clevis sd-encrypt lvm2 resume btrfs filesystems fsck)

I've also tried with mkinitcpio-netconf and mkinitcpio-nfs-utils to get the net hook working but I had no success.

Any advice on what to try next? Is there any clevis hook for systemd based initramfs available anywhere? Or am I missing something?

Any help is appreciated.

Last edited by 7thCore (2023-09-04 14:05:36)

[ Arch x86_64 | linux | Asus Prime X570-Pro | AMD Ryzen 9 5900X @4,8Ghz | AMD RX580 | 32GB RAM DDR4 | Main, 2 Monitors ]
[ Arch x86_64 | linux | Asus Pro WS X570-Ace | AMD Ryzen 9 5950X @4,9Ghz | Intel A750 | 128GB RAM DDR4 | Server ]

The Linux philosophy is 'Laugh in the face of danger'. Oops. Wrong One. 'Do it yourself'. Yes, that's it.


Board footer

Powered by FluxBB