DEV TOOLS Signal 409
NixOS servers achieve passphrase-less encrypted reboots via kexec with one-time LUKS keyslots
↗
A NixOS solution uses kexec with temporary LUKS keyslots and custom initramdisk images to enable fully automated reboots of encrypted servers without persisting passphrases on disk.
Servers with full-disk encryption typically require manual passphrase entry on every reboot, creating operational risk if the boot process stalls. This approach eliminates that dependency while maintaining encryption security, reducing reboot time to roughly two minutes with no human intervention.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
kexec allows the running kernel to replace itself without a hardware restart, passing decryption data through volatile RAM rather than persistent storage.
Temporary LUKS keyslots with one-time passphrases are created before reboot and deleted immediately after the root filesystem mounts.
The one-time passphrase is embedded in a custom initramdisk image rather than passed on the kernel command line to prevent exposure.
THE CLUSTER