logoalt Hacker News

SchemaLoadyesterday at 10:53 PM1 replyview on HN

TPM is probably the best solution here. The key can be automatically fetched on reboot unless the boot order is changed or the drive is put in another computer.

Realistically for a home server what you are worried about is someone breaking in and selling your drives on Facebook marketplace rather than the FBI raiding your nextcloud server. So TPM automated unlock is perfectly sufficient.


Replies

bogwogyesterday at 11:00 PM

> Realistically for a home server what you are worried about is someone breaking in and selling your drives on Facebook marketplace

If someone steals the entire machine, the drives will unlock themselves automatically. I don't think it's worth the risk to assume a hypothetical thief is too lazy to check if there's any valuable data on the disks. At the very least, they'll probably check for crypto wallets.

With something like Clevis and Tang, you can set it up so it only auto unlocks while connected to your home network, or do something more complex as needed

show 2 replies