Subject: [alpine-user] How to setup BTRFS and LUKS

From: Tristan Kohl <[email-masked]>
Date: Mon, 13 Aug 2018 13:19:23 +0200

Hey guys,

I stumbled upon Alpine a while back when building new docker images for
my home server currently running Debian stable. Since I was quite
intrigued by its minimalism, I gave it a shot in a VM to play around. I
must admit, I fell in love and made an USB drive to use on my home
server. Most things work flawelessly (samba, docker, etc.) but I do not
get how one would get a BTRFS pool on LUKS drives working.

I think I have to dig into OpenRC and drop some service in "sysinit" to
decrypt my drives before fstab kicks in (which as far as I can tell
happens in devfs). I have my crypttab setup to work with a keyfile which
resides in /root.

What I need:
1. Mapping all LUKS drives to /dev/mapper/poolX (setup in /etc/crypttab)
2. Run btrfs device scan to detect my pool
3. Mount pool according to fstab

I am a Linux desktop user for 7 years and I do prefer command line for
many tasks but when it comes to server setups that are just a tad more
advanced I feel like an absolute beginner. When I build my server some 5
years ago I did just some copypasta from a vast number of sites without
documenting anything. Plus Debian did a lot of magic out of the box I
did not even knew of. However this "featurefullness" also always bugged
me since I had no idea what was actually going on behind the scenes.

Hope someone can help me out here, any help is greatly appreciated.

Cheers,
Tristan

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Tristan Kohl <[email-masked]>
Date: Tue, 14 Aug 2018 12:58:35 +0200

I want to give a little update on my progress so far:

Thanks to Adam I was able to have my drives encrypted during boot.
However they still were not recognized by BTRFS as one coherent pool.

I then tried to put "btrfs device scan" at various places in
/etc/runlevel/boot/localmount and others but that did not change
anything. I can confirm that the command got executed since I wrote
"btrfs device scan > /scan.txt" which created a file containing
"Scanning for Btrfs filesystems" after boot. But somehow the scans'
result got lost afterwards. Even puttig it right before the line "moun
-at ..." inside localmount did not have any effect. I am lost right now
as to what else I can try to fix this.

As I read in Arch and Gentoo wiki they use some hooks in their initramfs
but I am not sure if that will help since decryption has to run before
scanning plus I do not find anything as to how one would use/configure
them in Alpine.

Does anyone smarter than me has any idea what else I could try?

Cheers,
Tristan

---

---

From: Adam Růžička <[email-masked]>
Date: Tue, 14 Aug 2018 16:49:41 +0200

Hi,
one thing comes to mind. I think I encountered something similar
and the cause was that the btrfs kernel module was not loaded
at the time when "btrfs device scan" was run. To put it another way,
the userspace btrfs tool tries to look for the drives but doesn't know
how to read them. Could you try

echo 'btrfs' > /etc/modules.d/btrfs.conf

and then reboot (+ lbu if you're using that).  Hope this helps

-- Adam

---

From: Tristan Kohl <[email-masked]>
Date: Tue, 14 Aug 2018 18:20:07 +0200

Oh...wait...That works!

You sir deserve a medal! Thank you so much, I was absolutely sure I put
it in there but must have removed it during one of my countless tries.

Thanks again, I can finally move my full setup over to Alpine now :)

Cheers,
Tristan

On 14.08.2018 16:49, Adam Růžička wrote:
> On Tue, Aug 14, 2018 at 12:58 PM, Tristan Kohl <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>     <mailto:[email-masked]>
>     <mailto:[email-masked]>
>     > ---
>     >
> 
> 
>     ---
>     <mailto:[email-masked]>
>     <mailto:[email-masked]>
>     ---
> 
> 

---

---

From: Dave Jones <[email-masked]>
Date: Fri, 17 Aug 2018 16:19:11 +0800

Hi Tristan,

Would you mind sharing your setup?  I tried to use keyfile to automount a
luks encrypted volume: root(/) partiton, added the line
"lvmcrypt /dev/vda2 /etc/mykeyfile luks" to /etc/crypttab, then run
"mkinitfs"
to regenerate initramfs, but it doesn't work.
Still prompts for passphrase :(

btw, i use ext4 file system, thanks.

---

From: Tristan Kohl <[email-masked]>
Date: Sun, 19 Aug 2018 19:46:22 +0200

Well it it quite simple, I just use a RAID1 configuration for my home
server.

/etc/crypttab is not bein used by Alpine to decrypt volumes, I had this
figured out by Adam's tip. Rather you enter your details in
/etc/conf.d/dmcrypt like this:

target=pool0
source=UUID="<UUID>"
key=/root/keyfile

Afterwards you add "btrfs" to /etc/modules so your kernel knows how to
handle those volumes once dmcrypt has mapped them after decryption. The
only thing to do then is to drop "/sbin/btrfs device scan" above "mount
-at "$types" $no_netdev" in /etc/init.d/localmount so there is a BTRFS
device scan run before fstab gets executed.

This should be all you have to do in order for your RAID1/5/6/10 to work
properly.

Cheers,
Tristan

On 17.08.2018 10:19, Dave Jones wrote:
>     > On Tue, Aug 14, 2018 at 12:58 PM, Tristan Kohl <[email-masked] <mailto:[email-masked]>
>     > <mailto:[email-masked] <mailto:[email-masked]>>> wrote:
>     >
>     >     > Hey guys,
>     >     >
>     >     > I stumbled upon Alpine a while back when building new docker
>     >     images for
>     >     > my home server currently running Debian stable. Since I was
>     quite
>     >     > intrigued by its minimalism, I gave it a shot in a VM to play
>     >     around. I
>     >     > must admit, I fell in love and made an USB drive to use on
>     my home
>     >     > server. Most things work flawelessly (samba, docker, etc.) but I
>     >     do not
>     >     > get how one would get a BTRFS pool on LUKS drives working.
>     >     >
>     >     > I think I have to dig into OpenRC and drop some service in
>     >     "sysinit" to
>     >     > decrypt my drives before fstab kicks in (which as far as I
>     can tell
>     >     > happens in devfs). I have my crypttab setup to work with a
>     keyfile
>     >     which
>     >     > resides in /root.
>     >     >
>     >     > What I need:
>     >     > 1. Mapping all LUKS drives to /dev/mapper/poolX (setup in
>     >     /etc/crypttab)
>     >     > 2. Run btrfs device scan to detect my pool
>     >     > 3. Mount pool according to fstab
>     >     >
>     >     > I am a Linux desktop user for 7 years and I do prefer
>     command line for
>     >     > many tasks but when it comes to server setups that are just
>     a tad more
>     >     > advanced I feel like an absolute beginner. When I build my
>     server
>     >     some 5
>     >     > years ago I did just some copypasta from a vast number of sites
>     >     without
>     >     > documenting anything. Plus Debian did a lot of magic out of
>     the box I
>     >     > did not even knew of. However this "featurefullness" also always
>     >     bugged
>     >     > me since I had no idea what was actually going on behind the
>     scenes.
>     >     >
>     >     > Hope someone can help me out here, any help is greatly
>     appreciated.
>     >     >
>     >     > Cheers,
>     >     > Tristan
>     >     >
>     >     >
>     >     >
>     >     >
>     >     >
>     >     >
>     >     > ---
>     >     > Unsubscribe:  [email-masked]
>     >     <mailto:[email-masked]
>     <mailto:[email-masked]>>
>     >     > Help:         [email-masked]
>     >     <mailto:[email-masked]
>     <mailto:[email-masked]>>
>     >     > ---
>     >     >
>     > 
>     > 
>     >     ---
>     >     <mailto:[email-masked]
>     <mailto:[email-masked]>>
>     >     <mailto:[email-masked]
>     <mailto:[email-masked]>>
>     >     ---
>     >
>     >
> 
> 
>     ---

---

---

From: Marco Dickert <[email-masked]>
Date: Mon, 13 Aug 2018 13:58:15 +0200

On 2018-08-13 13:19:23, Tristan Kohl wrote:
> Most things work flawelessly (samba, docker, etc.) but I do not get how one
> would get a BTRFS pool on LUKS drives working.
> 

I don't quite understand your problem. Did you read this [1]? Do you use
software raid (mdadm) or lvm? Anyway, make sure all the necessary features are
enabled in /etc/mkinitfs/mkinitfs.conf and rebuild it like described on the
linked wiki page.

If that does not work, please describe your exact problem with the setup.

[1] https://wiki.alpinelinux.org/wiki/Setting_up_disks_manually

Cheers,
-- 
Marco Dickert
[email-masked]
https://misterunknown.de

---

From: Tristan Kohl <[email-masked]>
Date: Mon, 13 Aug 2018 14:10:08 +0200

Sorry if I was not clear about my setup.

I do not encrypt my root partition which is an unencrypted 16G ext4 on a
cheap USB drive. But I do have 8 HDDs in my tower ranging from 2-8TB
which are setup as a BTRFS pool holding a bunch of subvolumes which get
mounted all over the place.

When I boot I need Alpine to decrypt those drives, map them to
/dev/mapper/pool{0,1,2,...} and then run "btrfs device scan" so BTRFS
knows about the pool before Alpine executes my fstab holding all mounts
for those subvolumes.

This is my drive setup from the old Debian install. If I SSH into Alpine
and perform those steps manually, everything works. However I do not
want to SSH into my server, decrypt every drive by hand, run "btrfs
device scan" and "mount -a" everytime it has to reboot. Plus my
containers break if those pools are not present when Docker starts up.

I hope this clarifies things, thank you for your quick response.

Cheers,
Tristan

---

---

From: Adam Růžička <[email-masked]>
Date: Mon, 13 Aug 2018 15:03:27 +0200

Take a look at the dmcrypt service (configured in /etc/conf.d/dmcrypt).
Maybe there's some other way but that's what I use.

-- Adam

---

From: Tristan Kohl <[email-masked]>
Date: Mon, 13 Aug 2018 16:07:12 +0200

Thanks, that did the trick decrypting my drives. But I do not get why
crypttab does not work since it is mentioned in the wiki?

However I still have half of the problem left, BTRFS is not made aware
of the pool before fstab tries to mount it which obviously fails. I need
to run "btrfs device scan" before that.

Cheers,
Tristan

On 13.08.2018 15:03, Adam Růžička wrote:
> On Mon, Aug 13, 2018, 14:10 Tristan Kohl <[email-masked]

---