Encryption

[Amplificator]

Can encryption be enabled so a password is required at boot?

[gkisuze]

This would require an updated zfs version like 0.8.4. I've customized the script to install zfs 0.8.4 and the machine boots okay. The only challenge is grub breaks when an encrypted dataset is created.
I think it will require a separate zpool for boot eg bpool so as not to break grub.
You can try out this script and ask members to create a separate zpool for boot. Get back to me if you're successful.
zfs-debian_edit_zfs_0.8.4.zip

[gkisuze]

#!/bin/bash -e

debian-buster-zfs-root.sh

Install Debian GNU/Linux 10 Buster to a native ZFS root filesystem

(C) 2018-2020 Hajo Noerenberg

http://www.noerenberg.de/

https://github.com/hn/debian-buster-zfs-root

This program is free software: you can redistribute it and/or modify

it under the terms of the GNU General Public License version 3.0 as

published by the Free Software Foundation.

This program is distributed in the hope that it will be useful,

but WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the

GNU General Public License for more details.

You should have received a copy of the GNU General Public License along

with this program. If not, see http://www.gnu.org/licenses/gpl-3.0.txt.

Static settings, overridable by TARGET_* environment variables

ZPOOL=${TARGET_ZPOOL:-rpool}
TARGETDIST=${TARGET_DIST:-buster}

PARTBIOS=${TARGET_PARTBIOS:-1}
PARTEFI=${TARGET_PARTEFI:-2}
PARTZFS=${TARGET_PARTZFS:-3}

SIZESWAP=${TARGET_SIZESWAP:-2G}
SIZETMP=${TARGET_SIZETMP:-3G}
SIZEVARTMP=${TARGET_VARTMP:-3G}

NEWHOST=${TARGET_HOSTNAME}
NEWDNS=${TARGET_DNS:-8.8.8.8 8.8.4.4}

User settings

declare -A BYID
while read -r IDLINK; do
BYID["$(basename "$(readlink "$IDLINK")")"]="$IDLINK"
done < <(find /dev/disk/by-id/ -type l)

for DISK in $(lsblk -I8,254,259 -dn -o name); do
if [ -z "${BYID[$DISK]}" ]; then
SELECT+=("$DISK" "(no /dev/disk/by-id persistent device name available)" off)
else
SELECT+=("$DISK" "${BYID[$DISK]}" off)
fi
done

TMPFILE=$(mktemp)
whiptail --backtitle "$0" --title "Drive selection" --separate-output
--checklist "\nPlease select ZFS drives\n" 20 74 8 "${SELECT[@]}" 2>"$TMPFILE"

if [ $? -ne 0 ]; then
exit 1
fi

while read -r DISK; do
if [ -z "${BYID[$DISK]}" ]; then
DISKS+=("/dev/$DISK")
ZFSPARTITIONS+=("/dev/$DISK$PARTZFS")
EFIPARTITIONS+=("/dev/$DISK$PARTEFI")
else
DISKS+=("${BYID[$DISK]}")
ZFSPARTITIONS+=("${BYID[$DISK]}-part$PARTZFS")
EFIPARTITIONS+=("${BYID[$DISK]}-part$PARTEFI")
fi
done < "$TMPFILE"

whiptail --backtitle "$0" --title "RAID level selection" --separate-output
--radiolist "\nPlease select ZFS RAID level\n" 20 74 8
"RAID0" "Striped disks or single disk" off
"RAID1" "Mirrored disks (RAID10 for n>=4)" on
"RAIDZ" "Distributed parity, one parity block" off
"RAIDZ2" "Distributed parity, two parity blocks" off
"RAIDZ3" "Distributed parity, three parity blocks" off 2>"$TMPFILE"

if [ $? -ne 0 ]; then
exit 1
fi

RAIDLEVEL=$(head -n1 "$TMPFILE" | tr '[:upper:]' '[:lower:]')

case "$RAIDLEVEL" in
raid0)
RAIDDEF="${ZFSPARTITIONS[*]}"
;;
raid1)
if [ $((${#ZFSPARTITIONS[@]} % 2)) -ne 0 ]; then
echo "Need an even number of disks for RAID level '$RAIDLEVEL': ${ZFSPARTITIONS[@]}" >&2
exit 1
fi
I=0
for ZFSPARTITION in "${ZFSPARTITIONS[@]}"; do
if [ $((I % 2)) -eq 0 ]; then
RAIDDEF+=" mirror"
fi
RAIDDEF+=" $ZFSPARTITION"
((I++)) || true
done
;;
)
if [ ${#ZFSPARTITIONS[@]} -lt 3 ]; then
echo "Need at least 3 disks for RAID level '$RAIDLEVEL': ${ZFSPARTITIONS[@]}" >&2
exit 1
fi
RAIDDEF="$RAIDLEVEL ${ZFSPARTITIONS[]}"
;;
esac

GRUBPKG=grub-pc
if [ -d /sys/firmware/efi ]; then
whiptail --backtitle "$0" --title "EFI boot" --separate-output
--menu "\nYour hardware supports EFI. Which boot method should be used in the new to be installed system?\n" 20 74 8
"EFI" "Extensible Firmware Interface boot"
"BIOS" "Legacy BIOS boot" 2>"$TMPFILE"

if [ $? -ne 0 ]; then
	exit 1
fi
if grep -qi EFI $TMPFILE; then
	GRUBPKG=grub-efi-amd64
fi

fi

whiptail --backtitle "$0" --title "Confirmation"
--yesno "\nAre you sure to destroy ZFS pool '$ZPOOL' (if existing), wipe all data of disks '${DISKS[*]}' and create a RAID '$RAIDLEVEL'?\n" 20 74

if [ $? -ne 0 ]; then
exit 1
fi

Start the real work

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=595790

if [ "$(hostid | cut -b-6)" == "007f01" ]; then
dd if=/dev/urandom of=/etc/hostid bs=1 count=4
fi

DEBRELEASE=$(head -n1 /etc/debian_version)
case $DEBRELEASE in
9*)
echo "deb http://deb.debian.org/debian/ stretch-backports contrib main non-free" >/etc/apt/sources.list.d/contrib-non-free.list
test -f /var/lib/apt/lists/deb.debian.org_debian_dists_stretch-backports_non-free_binary-amd64_Packages || apt-get update
if [ ! -d /usr/share/doc/zfs-dkms ]; then NEED_PACKAGES+=(zfs-dkms); fi
;;
10*)
echo "deb http://deb.debian.org/debian/ buster-backports main contrib non-free" >/etc/apt/sources.list.d/contrib-non-free.list
test -f /var/lib/apt/lists/deb.debian.org_debian_dists_buster-backports_non-free_binary-amd64_Packages || apt-get update
if [ ! -d /usr/share/doc/zfs-dkms ]; then NEED_PACKAGES+=(zfs-dkms); fi
;;
)
echo "Unsupported Debian Live CD release" >&2
exit 1
;;
esac
if [ ! -f /sbin/zpool ]; then NEED_PACKAGES+=(zfsutils-linux); fi
if [ ! -f /usr/sbin/debootstrap ]; then NEED_PACKAGES+=(debootstrap); fi
if [ ! -f /sbin/sgdisk ]; then NEED_PACKAGES+=(gdisk); fi
if [ ! -f /sbin/mkdosfs ]; then NEED_PACKAGES+=(dosfstools); fi
echo "Need packages: ${NEED_PACKAGES[@]}"
if [ -n "${NEED_PACKAGES[]}" ]; then DEBIAN_FRONTEND=noninteractive apt-get install --yes "${NEED_PACKAGES[@]}"; fi

modprobe zfs
if [ $? -ne 0 ]; then
echo "Unable to load ZFS kernel module" >&2
exit 1
fi
test -d /proc/spl/kstat/zfs/$ZPOOL && zpool destroy $ZPOOL

for DISK in "${DISKS[@]}"; do
echo -e "\nPartitioning disk $DISK"

sgdisk --zap-all $DISK

sgdisk -a1 -n$PARTBIOS:34:2047   -t$PARTBIOS:EF02 \
           -n$PARTEFI:2048:+512M -t$PARTEFI:EF00 \
               -n$PARTZFS:0:0        -t$PARTZFS:BF01 $DISK

done

sleep 2

zpool create -f -o ashift=12 -o altroot=/target -O atime=off -O mountpoint=none $ZPOOL $RAIDDEF
if [ $? -ne 0 ]; then
echo "Unable to create zpool '$ZPOOL'" >&2
exit 1
fi

zfs set compression=lz4 $ZPOOL

The two properties below improve performance but reduce compatibility with non-Linux ZFS implementations

Commented out by default

#zfs set xattr=sa $ZPOOL
#zfs set acltype=posixacl $ZPOOL

zfs create $ZPOOL/ROOT
zfs create -o mountpoint=/ $ZPOOL/ROOT/debian-$TARGETDIST
zpool set bootfs=$ZPOOL/ROOT/debian-$TARGETDIST $ZPOOL

zfs create -o mountpoint=/tmp -o setuid=off -o exec=off -o devices=off -o com.sun:auto-snapshot=false -o quota=$SIZETMP $ZPOOL/tmp
chmod 1777 /target/tmp

/var needs to be mounted via fstab, the ZFS mount script runs too late during boot

zfs create -o mountpoint=legacy $ZPOOL/var
mkdir -v /target/var
mount -t zfs $ZPOOL/var /target/var

/var/tmp needs to be mounted via fstab, the ZFS mount script runs too late during boot

zfs create -o mountpoint=legacy -o com.sun:auto-snapshot=false -o quota=$SIZEVARTMP $ZPOOL/var/tmp
mkdir -v -m 1777 /target/var/tmp
mount -t zfs $ZPOOL/var/tmp /target/var/tmp
chmod 1777 /target/var/tmp

zfs create -V $SIZESWAP -b "$(getconf PAGESIZE)" -o primarycache=metadata -o com.sun:auto-snapshot=false -o logbias=throughput -o sync=always $ZPOOL/swap

sometimes needed to wait for /dev/zvol/$ZPOOL/swap to appear

sleep 2
mkswap -f /dev/zvol/$ZPOOL/swap

zpool status
zfs list

debootstrap --include=openssh-server,locales,linux-headers-amd64,linux-image-amd64,joe,rsync,sharutils,psmisc,htop,patch,less --components main,contrib,non-free $TARGETDIST /target http://deb.debian.org/debian/

test -n "$NEWHOST" || NEWHOST=debian-$(hostid)
echo "$NEWHOST" >/target/etc/hostname
sed -i "1s/^/127.0.1.1\t$NEWHOST\n/" /target/etc/hosts

Copy hostid as the target system will otherwise not be able to mount the misleadingly foreign file system

cp -va /etc/hostid /target/etc/

cat << EOF >/target/etc/fstab

/etc/fstab: static file system information.

Use 'blkid' to print the universally unique identifier for a

device; this may be used with UUID= as a more robust way to name devices

that works even if disks are added and removed. See fstab(5).

/dev/zvol/$ZPOOL/swap none swap defaults 0 0
$ZPOOL/var /var zfs defaults 0 0
$ZPOOL/var/tmp /var/tmp zfs defaults 0 0
EOF

mount --rbind /dev /target/dev
mount --rbind /proc /target/proc
mount --rbind /sys /target/sys
ln -s /proc/mounts /target/etc/mtab

perl -i -pe 's/# (en_US.UTF-8)/$1/' /target/etc/locale.gen
echo 'LANG="en_US.UTF-8"' > /target/etc/default/locale
chroot /target /usr/sbin/locale-gen
chroot /target /usr/bin/echo "deb http://deb.debian.org/debian buster-backports main contrib non-free" > /target/etc/apt/sources.list
chroot /target /usr/bin/echo "deb http://deb.debian.org/debian/ buster main" >> /target/etc/apt/sources.list
chroot /target /usr/bin/apt-get update

chroot /target /usr/bin/apt-get install --yes grub2-common $GRUBPKG zfs-initramfs zfs-dkms linux-headers-$(uname -r) linux-image-amd64
grep -q zfs /target/etc/default/grub || perl -i -pe 's/quiet/boot=zfs quiet/' /target/etc/default/grub
chroot /target /usr/sbin/update-grub

if [ "${GRUBPKG:0:8}" == "grub-efi" ]; then

# "This is arguably a mis-design in the UEFI specification - the ESP is a single point of failure on one disk."
# https://wiki.debian.org/UEFI#RAID_for_the_EFI_System_Partition
mkdir -pv /target/boot/efi
I=0
for EFIPARTITION in "${EFIPARTITIONS[@]}"; do
	mkdosfs -F 32 -n EFI-$I $EFIPARTITION
	mount $EFIPARTITION /target/boot/efi
	chroot /target /usr/sbin/grub-install --target=x86_64-efi --no-uefi-secure-boot --efi-directory=/boot/efi --bootloader-id="Debian $TARGETDIST (RAID disk $I)" --recheck --no-floppy
	umount $EFIPARTITION
	if [ $I -gt 0 ]; then
		EFIBAKPART="#"
	fi
	echo "${EFIBAKPART}PARTUUID=$(blkid -s PARTUUID -o value $EFIPARTITION) /boot/efi vfat defaults 0 1" >> /target/etc/fstab
	((I++)) || true
done

fi

if [ -d /proc/acpi ]; then
chroot /target /usr/bin/apt-get install --yes acpi acpid
chroot /target service acpid stop
fi

ETHDEV=$(udevadm info -e | grep "ID_NET_NAME_ONBOARD=" | head -n1 | cut -d= -f2)
test -n "$ETHDEV" || ETHDEV=$(udevadm info -e | grep "ID_NET_NAME_PATH=" | head -n1 | cut -d= -f2)
test -n "$ETHDEV" || ETHDEV=enp0s1
echo -e "\nauto $ETHDEV\niface $ETHDEV inet dhcp\n" >>/target/etc/network/interfaces
for DNS in $NEWDNS; do
echo -e "nameserver $DNS" >> /target/etc/resolv.conf
done

chroot /target /usr/bin/passwd
chroot /target /usr/sbin/dpkg-reconfigure tzdata

sync

#zfs umount -a

chroot /target /bin/bash --login

zpool import -R /target rpool

[gkisuze]

Hi @Amplificator I just found another install script that can help you install with encryption. It doesn't even have any issues with UEFI boot. Check it out here: https://github.com/HankB/Linux_ZFS_Root
Just make configurations to suit your set up in env.sh and the rest will go smoothly.