MIME-Version: 1.0
References: <CAFosHnHD90XOnV=T7L7Y1UmVusk9DmeyROnuLHquMPtoRXeOVQ@mail.gmail.com>
 <20200109075809.GA20690@marco.lxc>
In-Reply-To: <20200109075809.GA20690@marco.lxc>
From: James Chase <mr.jdchase@gmail.com>
Date: Fri, 10 Jan 2020 16:38:45 -0500
Message-ID: <CAFosHnGOBBakm=oAa8Un40cirzWtYH-mgKnEjSi_-p20eWCD-A@mail.gmail.com>
Subject: Re: Decrypt LVM containing primary OS from USB on boot
To: Marco Dickert <marco@misterunknown.de>
Cc: ~alpine/users@lists.alpinelinux.org
Content-Type: text/plain; charset="UTF-8"

> I don't use a crypted setup, but found this [1] page which describes
> what you want to achieve, at least as far as I understand. This may
> help you.

Thanks! This was definitely a step in the right direction. It looks like
there may be some differences in the kernel parameters from Arch to
Alpine, although I'm not sure. I tried:

/etc/update-extlinux.conf
default_kernel_opts="nomodeset rootfstype=ext4
cryptdevice=UUID=*uuid*:lvmcrypt cryptkey=/dev/sdd1:vfat:/secretkey
cryptroot=UUID
=*uuid* cryptdm=lvmcrypt"

And several variations. Nothing appears to be working or really even
changing at all. I can see /dev/sdd1 gets recognized before it asks
for a PW to log in, so at least the USB modules appear to be loading
correctly. Arch docs have no mention of "cryptroot" or "cryptdm" as
far as I can tell, whereas Alpine docs do. Alpine docs make no mention
of "cryptdevice" either. Either I'm screwing up the config or there
may be different params for the two OS's. I guess another possibility
is going to be to put a key on a raw block device then put a shell
script in initramfs, but I'd rather avoid that if possible. Thanks for
the help, I'll keep trying stuff.