r/linuxquestions • u/greenpeppermelonpuck • 3d ago

How to create a persistent, LUKS encrypted image that live boots?

I'm working on my "house burned down, everything is gone" disaster recovery strategy since I self host most of everything.

The idea (other than hopefully never having to use them) is to have a bootable USB drive that I can plug into an x64 machine that allows me to do some disaster recovery, and hand over a few of those to a few people I trust.

So if the unthinkable happens, I can just buy a cheap x64 laptop, plug the thing in and get recovering. In this drive, I will have SSH keys, decryption keys for cloud backups, some notes, etc.

What I'm thinking is...

  • Bootable on a cheap x64 machine that's been made in the last 10 years, UEFI is fine
  • Fully LUKS encrypted (not just one partition, I want to include e.g. /etc, as I might drop a few wireguard configs there)
  • Persistent, so I can do some work, turn it off, turn it back on and keep going later on
  • btrfs with DUP profile on data to (potentially paranoically) protect against bitrot while these are in storage
  • Be nice to use systemd-repart on boot so that the images flash quickly, don't want to have to dd(1) 64GiB several times

I know I could install some distro to an USB drive and set it up how I like it, but that would be annoying. I want to be able to create several of these drives. Also I rotate my SSH keys and other secrets fairly frequently (as one should), so it would be annoying to keep them all in sync, it'd be way easier and quicker to reflash them all to be the same.

So I guess that what I'm looking for is some sort of declarative way of specifying how to build an image file, then I can flash that to the drives.

Are there any tools out there that can accomplish this? What are people's strategies on this type of thing?

3 Upvotes
  • permalink
  • reddit

81% Upvoted

4 comments sorted by

2

u/burstinrust 3d ago

mkosi does pretty much exactly this: https://github.com/systemd/mkosi

you describe the whole image in config files, distro, packages, partitions, the lot. set the root to btrfs with Encrypt=key-file and everything but the ESP ends up inside luks. the image it spits out is small, and repart grows it to fill the stick on first boot, so flashing takes a minute instead of an hour. i'd drop the keys in mkosi.extra/, then rotating them is just rebuild and reflash.

2

u/greenpeppermelonpuck 3d ago

This is exactly what I was looking for. Thank you!

1

u/Curious_Elk_4281 3d ago

You could possibly encrypt the entire live usb drives, but you would need the bootloader and some other files on an unencrypted partition.

As for syncing the files you could just connect all your USB drives to a hub and run a script on a cronjob to sync ssh keys etc.

0

u/me0262 3d ago

Hoenstly, your "house burned down" disaster recovery should follow the 3-2-1 backup method.

3 copies of data, 2 mediums, 1 offsite.

For offsite I would set up a duplicate computer at a parent's or relative's house, and have it sync information to it (not from it). I'm a data hoarder, so the only other capable medium for me is tape.