Disk Encryption

Disk passphrases are kept one file per user under secrets/disks/; see the Secrets concept for the trust model behind them.

You can give each of a host’s owners — its normal users, listed by disk.owners — their own passphrase to unlock its encrypted disk. A passphrase lives in secrets/disks/<user>.yaml under a passphrase key:

passphrase: a-good-passphrase

Record or change one with, e.g., sops secrets/disks/alice.yaml. This is version-control work: the file is the source of truth for who may unlock the disk. A fresh machine picks these passphrases up when it is installed (see Installing a machine).

Align a machine with version control

On a machine that is already running, two recipes reconcile its keyslots with version control:

just luks-status   # what is enrolled, missing, or stale on this machine
just luks-sync     # enrol missing passphrases, drop ones no longer recorded

luks-status reports which owners’ passphrases are enrolled as keyslots, which are missing, and whether the disk carries extra slots that no recorded passphrase explains. luks-sync then enrols any owner passphrase that is not yet a keyslot and — when it can decrypt every owner’s passphrase — kills any keyslot that no recorded passphrase opens.

Add, rotate, and revoke

On a running machine, adding an owner is two moves: record the passphrase under version control, then enrol it on the machine.

sops secrets/disks/alice.yaml   # add a `passphrase:` value
just luks-sync                  # on the machine, enrols the new slot

Rotating a passphrase is the same two moves again: change the value, then luks-sync enrols the new passphrase and kills the slot the old one opened.

Revoking a developer’s access takes both moves together, because a developer who could decrypt a passphrase already knows it. Removing them as a reader stops them decrypting the file from now on, but not remembering what they read.

Drop them from that file’s readers in .sops.yaml, then sops updatekeys secrets/disks/alice.yaml so it is no longer encrypted to them.
Rotate the passphrase and run just luks-sync on each affected machine, so the slot the old passphrase opened is gone.

The first move alone is not enough: until the passphrase is rotated and its slot killed, the old one still unlocks the disk.