nimmo/nixos-config

Watch

Fork 0

Decide and implement disk encryption for lena and vega #37

New issue

Closed

opened 2026-07-01 19:36:38 +01:00 by nimmo · 1 comment

nimmo commented

2026-07-01 19:36:38 +01:00

Owner

Context

lena and vega currently use plain Btrfs layouts. This is a physical-access weakness for a laptop and may become increasingly significant on vega as private service state moves into /srv/services.

Relevant files:

hosts/lena/disko.nix
hosts/vega/disko.nix
hosts/electra/hardware-configuration.nix as the encrypted reference

Scope

Add LUKS around root/home for lena at a convenient reinstall opportunity.
Decide whether vega needs full-disk encryption based on physical access, unattended reboot requirements, and the sensitivity of migrated service data.
If vega remains unencrypted, document the accepted threat model explicitly.

Completion criteria

The encryption decision is recorded for both hosts.
Any chosen implementation is deployed and recovery-tested.
Recovery documentation and backup prerequisites are updated in the wiki.

## Context `lena` and `vega` currently use plain Btrfs layouts. This is a physical-access weakness for a laptop and may become increasingly significant on vega as private service state moves into `/srv/services`. Relevant files: - `hosts/lena/disko.nix` - `hosts/vega/disko.nix` - `hosts/electra/hardware-configuration.nix` as the encrypted reference ## Scope - Add LUKS around root/home for lena at a convenient reinstall opportunity. - Decide whether vega needs full-disk encryption based on physical access, unattended reboot requirements, and the sensitivity of migrated service data. - If vega remains unencrypted, document the accepted threat model explicitly. ## Completion criteria - The encryption decision is recorded for both hosts. - Any chosen implementation is deployed and recovery-tested. - Recovery documentation and backup prerequisites are updated in the wiki.

nimmo added this to the Security Hardening milestone

2026-07-01 19:36:38 +01:00

nimmo added the

project:security-hardening

host:fleet

labels

2026-07-01 19:36:38 +01:00

nimmo commented

2026-07-20 15:34:36 +01:00

Author

Owner

Decision (2026-07-20)

Neither host will receive LUKS disk encryption at this time. The encryption decision is recorded for both hosts, satisfying the first completion criterion; implementation (criterion 2) and recovery-doc updates (criterion 3) are N/A by choice.

vega: remain unencrypted — operational reliability on an unattended headless server is prioritised over at-rest encryption.
lena: remain unencrypted until a convenient reinstall opportunity; no LUKS added to disko.nix yet.

What would reopen this

vega begins holding data whose exposure on physical loss is unacceptable.
a lena reinstall, at which point LUKS should be added to disko.nix.

The full rationale is recorded in private notes, not here.

## Decision (2026-07-20) Neither host will receive LUKS disk encryption at this time. The encryption decision is recorded for both hosts, satisfying the first completion criterion; implementation (criterion 2) and recovery-doc updates (criterion 3) are N/A by choice. - **vega**: remain unencrypted — operational reliability on an unattended headless server is prioritised over at-rest encryption. - **lena**: remain unencrypted until a convenient reinstall opportunity; no LUKS added to disko.nix yet. ### What would reopen this - vega begins holding data whose exposure on physical loss is unacceptable. - a lena reinstall, at which point LUKS should be added to disko.nix. The full rationale is recorded in private notes, not here.

nimmo closed this issue

2026-07-20 15:34:41 +01:00

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

nimmo/nixos-config#37

No description provided.

Rows
Columns