Debian install btrfs directly on LUKS

debian-btrfs-on-luks.md

Install Debian using BTRFS as root directly on LUKS (without LVM)

1. Use non-grphical expert install mode Advanced options -> Expert install
2. Enable all relevant crypto, fdisk, parted, and rescue installer modules.
3. Run setup down to and including detect disks
4. At the agenda menu select the second to last step that says Execute a shell
5. Provision the LUKS an BTRFS volumes

   parted -s -a optimal /dev/sda \
     mklabel gpt \
     mkpart efi fat32 1MiB 1025MiB \
     set 1 esp on \  
     mkpart boot btrfs 1025MiB 3073MiB \
     mkpart cryptroot 3073MiB 100%
   fdisk -l
   
   mkfs.fat -F 32 -n EFI /dev/sda1
   mkfs.btrfs -f -L boot /dev/sda2
   
   cryptsetup luksFormat --sector-size 4096 /dev/sda3
   cryptsetup open /dev/sda3 sda3_crypt
   mkfs.btrfs -f -L root /dev/mapper/sda3_crypt

6. Continue to partitioning step Partition disks. Select Manual setup
7. Select the root btrfs volume and say use as /
8. Select the boot btrfs volume and use as /boot
9. Continue without swap, since you can add a swap file later on top of the btrfs volume
10. Install base system and selected package groups. Along the way, cryptsetup will be installed in the target, which will setup a template /etc/crypttab. Stop before Install the GRUB boot loader.
11. Fixup crypttab Open the Shell agenda step, again and create the /etc/crypttab file as follows:

UUID="$(cryptsetup luksUUID /dev/sda3)"
#echo '# <target name> <source device> <key file> <options>' >/target/etc/crypttab
echo "sda3_crypt UUID=$UUID none luks,discard" >>/target/etc/crypttab

12. The Finishing the installation step seems to update-initramfs.

Extra Tips

• chroot /target then exec bash to drop into the bootstrapped root
• To check the generated initrd for the valid crypttab, you can do something like the following:

  chroot /target bash
  lsinitramfs /boot/initrd.img-7.0.12 | grep crypttab
  mkdir /tmp/initrd
  unmkinitramfs /boot/initrd.img-7.0.12 /tmp/initrd
  find /tmp/initrd -name crypttab
  # cat $(find /tmp/initrd -name crypttab)

• in-target can be used after the base install step to run commands in the target chroot.

Setup TPM Unlock

Only use these steps for machine you don't are about fully securing.

sudo apt install dracut
#sudo apt install systemd-cryptsetup

# If you have an encrypted rootfs already, you need to
# enable `hostonly` mode, so that dracut will scan your root filesystem
# and add steps to unlcok dependent luks volumes. This even works correctly
# for btrfs volumes that depend on two luks volumes for a raid1.
echo 'hostonly="yes"' | sudo tee -a /etc/dracut.conf.d/options.conf

sudo apt install tpm2-tools
echo 'add_dracutmodules+=" tpm2-tss "' | sudo tee -a /etc/dracut.conf.d/options.conf

systemd-cryptenroll --tpm2-device=list
# You can also select different PCRs. Watch out the default PCRs changes on latest Debian. I think it is no PCRs by default.
systemd-cryptenroll --tpm2-device=auto

# You don't need to add "tpm2-device=auto" in crypttab.

sudo dracut --regenerate-all -f

Swap Setup

sudo mkdir /var/swap
sudo btrfs filesystem mkswapfile --size 8g /var/swap/swapfile1

echo '# Cannot handle more than one swapfile on BTRFS' >>/etc/fstab
echo '/var/swap/swapfile1    none                     swap defaults 0 0' >>/etc/fstab

sudo systemctl daemon-reload
sudo swapon -a

sudo swapon --show