Differences

This shows you the differences between two versions of the page.

--- installs:raspi:argon-oneup:home-setup [2026/03/01 16:11] – created elraphik
+++ installs:raspi:argon-oneup:home-setup [2026/03/01 20:42] (current) – change info size elraphik
@@ Line 1: / Line 1: @@
 ====== Home Setup ======
+As said in prior pages, the goal here is to make the SSD the home directory, with encryption enabled, as it is not recommended to do it on the eMMC.
+===== SSD Cleaning and Encryption =====
+So be careful your device does not contain any data you'd like to recover. Mine is brand new so it's not a consideration I have, however I'll still run a couple commands to wipe it.
+<code bash>
+export DEVICE=/dev/nvme0n1
+export PART=/dev/nvme0n1p1
+# Wipe disk
+sudo wipefs -a $DEVICE
+# Make the partition, once in fdisk use g for new GPT table, n for new partition, w to write
+# When making the partition, choose the defaults for a full-disk partition
+sudo fdisk $DEVICE
+g
+n
+w
+# Install cryptsetup and use it to encrypt the device with a passkey
+sudo apt update && sudo apt install cryptsetup -y
+sudo cryptsetup luksFormat $PART
+# Now open the device with passkey, it should be located at /dev/mapper/crypt_home now
+sudo cryptsetup open $PART crypt_home
+export VOLUME=/dev/mapper/crypt_home
+# Add a filesystem to the volume, and add a label
+sudo mkfs.ext4 $VOLUME
+sudo e2label $VOLUME home
+</code>
+You now have an encrypted disk with a single partition, that has a filesystem, great job!
+Now, you may have to migrate the old home files into the new one before we continue, here's how to do so:
+<code bash>
+# Make temporary mount for migration + configuration
+sudo mkdir /mnt/newhome
+sudo mount /dev/mapper/crypt_home /mnt/newhome
+# Migrate data from old home to new home, trailing slashes are important
+sudo rsync -aAXv /home/ /mnt/newhome/
+</code>
+Great! Let's not configure the auto-mount and auto-decryption of the device on boot.
+<code bash>
+# Retrieve UUID of the partition
+sudo blkid $PART
+# Should return /dev/nvme0n1: UUID="xxxxxxxx-xxxx-xxxx" TYPE="crypto_LUKS"
+sudo nano /etc/crypttab
+# Add crypt_home UUID=YOUR-UUID none luks,initramfs
+# Now configure your fstab
+sudo blkid $VOLUME
+sudo nano /etc/fstab
+# Add /dev/mapper/crypt_home /home  ext4  defaults,noatime  0  2
+</code>
+<WRAP center round info 100%>
+If you pay attention here, you'll notice the "initramfs" option in the crypttab.\\
+I noticed that when booting, the prompt for the decryption passphrase does not appear if the disk decryption does not happen during the initramfs boot phase. If not present, it'll try to decypher during the systemd phase, in which you cannot interact with the prompt, so it will timeout and fail pretty hard.
+</WRAP>
+Okay now it's almost all set, just need to move some folders around :
+<code bash>
+# Archive old home
+sudo mv /home /home_old
+sudo mkdir /home
+</code>
+You **should** now be able to reboot, and the boot process should ask for a passphrase.\\
+However, if you're like me, you'll need a couple extra steps:
+<code bash>
+# Install initramfs crypt support
+sudo apt install cryptsetup-initramfs
+# Regen initramfs
+sudo update-initramfs -c -k all
+# Now reboot
+sudo reboot
+</code>