Comment on [deleted]
i_am_not_a_robot@discuss.tchncs.de 5 weeks ago
Tang and Clevis have already been mentioned as a way for one server to boot using another server.
You can also create an environment where the server boots into a phase 1 where it obtains network connectivity and then waits for you to provide it the key to continue booting. The first phase is unencrypted, so don’t put sensitive data in there.
i_am_not_a_robot@discuss.tchncs.de 5 weeks ago
A less intrusive solution would be to just put your sensitive data in LUKS and configure services that use that data to depend on the partition being mounted. That doesn’t require modifying the normal system startup process. You’re less likely to mess up your startup process at the expense of needing to be more mindful about where you’re putting your files.