.Dd September 27, 2026
.Dt ENCRYPTION 7
.Os
.Sh NAME
.Nm encryption
.Nd installing rawnix on encrypted disks
.Sh DESCRIPTION
rawnix encrypts with LUKS2.
The root file system is always encrypted; other partitions may be.
The EFI system partition never is.
.Pp
Encryption needs only one passphrase at boot.
The initramfs asks for it and unlocks root.
Every other encrypted partition has a key file on the encrypted root,
.Pa /etc/cryptkeys/ Ns Ar name Ns Pa .key ,
and is listed in
.Pa /etc/crypttab ;
.Pa /etc/runit/1
opens them from there.
Each of them also accepts the passphrase, as a way in when root cannot
be mounted.
.Pp
So the root passphrase protects every volume, and it is the one that
has to be good.
It is typed at boot before any keyboard layout is loaded: use ASCII,
entered as on a US keyboard.
.Ss Installing
After partitioning, see
.Xr partition 7 ,
.Xr genluks 8
does the rest in one command: it formats, opens, makes the file systems,
mounts everything under the mount point, creates the key files and
writes
.Pa /etc/crypttab .
It shows what it is about to erase and waits for
.Li yes .
.Bd -literal -offset indent
# genluks /mnt /dev/sdX2:/
# genluks /mnt /dev/sdX2:/ /dev/sdX3:/var /dev/sdX4:/home /dev/sdX5:swap
# genluks /mnt /dev/sdX2:/ /dev/sdX9:/data:plain,xfs
.Ed
.Pp
Each argument is
.Sm off
.Ar device : target Op : options ,
.Sm on
where
.Ar target
is a mount point or the word
.Li swap ,
and
.Ar options
is
.Li plain
for no encryption and/or
.Li ext4 ,
.Li xfs
or
.Li btrfs .
.Pp
Then format and mount the EFI system partition as in
.Xr partition 7 ,
and go on with
.Ic setup-filesystem /mnt .
.Xr setup-boot 8
finds the encrypted root and puts
.Li cryptroot=
in the kernel command line.
.Ss Adding an encrypted partition later
On the installed system, as root.
Format and open it under a name of your choice, here
.Li cdata ,
make a file system and mount it:
.Bd -literal -offset indent
# cryptsetup luksFormat --type luks2 /dev/sdXn
# cryptsetup open /dev/sdXn cdata
# mkfs.ext4 /dev/mapper/cdata
# mkdir -p /data && mount /dev/mapper/cdata /data
.Ed
.Pp
Give it a key file on root so it opens at boot without a prompt:
.Bd -literal -offset indent
# mkdir -p /etc/cryptkeys && chmod 700 /etc/cryptkeys
# head -c 64 /dev/urandom > /etc/cryptkeys/cdata.key
# chmod 400 /etc/cryptkeys/cdata.key
# cryptsetup luksAddKey /dev/sdXn /etc/cryptkeys/cdata.key
.Ed
.Pp
List it in
.Pa /etc/crypttab ,
with the UUID from
.Ic cryptsetup luksUUID /dev/sdXn :
.Bd -literal -offset indent
cdata  UUID=<uuid>  /etc/cryptkeys/cdata.key  luks
.Ed
.Pp
Finally add it to
.Pa /etc/fstab .
.Ic genfstab / > /etc/fstab.new
writes a table of everything mounted now, to copy the new line from.
.Sh FILES
.Bl -tag -width Ds
.It Pa /etc/crypttab
Encrypted volumes other than root, opened at boot.
Its header describes the format.
.It Pa /etc/cryptkeys/
Key files, one per volume, mode 400.
.El
.Sh SEE ALSO
.Xr bootloader 7 ,
.Xr installation 7 ,
.Xr partition 7 ,
.Xr cryptsetup 8 ,
.Xr genluks 8 ,
.Xr setup-boot 8