ehrenfeu · May 15, 2026 12:03
diff --git a/README.md b/README.md
diff --git a/Desktop.md b/Desktop.md
diff --git a/u2404-encrypted-btrfs.sh b/u2404-encrypted-btrfs.sh
 #!/bin/sh

 set -e

 MP_BTRFS=/mnt/btrfs
 MP_ROOT=/mnt/root
 MP_HOME=/mnt/home

 KEYSLOT_SIZE=32m

 DEV_ROOT=/dev/nvme0n1p3
 DEV_BOOT=/dev/nvme0n1p1
 DEV_EFI=/dev/nvme0n1p2

 # cleanup leftover mounts from installer:
 umount --quiet /target/boot/efi
 umount --quiet /target/boot
 umount --quiet /target/cdrom
 umount --quiet /target

 # create mountpoints
 mkdir -pv $MP_BTRFS
 mkdir -pv $MP_ROOT
 mkdir -pv $MP_HOME

 # create subvolumes
 mount $DEV_ROOT $MP_ROOT
 cd $MP_ROOT

 # create a snapshot "@" from current btrfs, will become the new "/" mount later:
 btrfs subvolume snapshot . @
 # create @home subvol
 btrfs subvolume create @home

 # re-mount "bare" btrfs, root and home subvolumes:
 umount $MP_ROOT
 mount $DEV_ROOT $MP_BTRFS
 mount $DEV_ROOT -o subvol=@ $MP_ROOT
 mount $DEV_ROOT -o subvol=@home $MP_HOME

 # move home dirs from @ subvol to @home:
 mv $MP_ROOT/home/* $MP_HOME/

 # delete everything but the subvolumes from the btrfs-root:
 find $MP_BTRFS -maxdepth 1 \! -name "@*" \! -name . -exec rm -Rf {} \;

 # make space for the key slot
 btrfs filesystem resize -$KEYSLOT_SIZE $MP_ROOT

 umount $MP_ROOT
 umount $MP_HOME
 umount $MP_BTRFS

 # identify disk and partition number:
 DISK=$(lsblk --noheadings --output pkname $DEV_ROOT)
 PART_NUM=$(lsblk --noheadings --output partn $DEV_ROOT  | tr -d "[:space:]")
 echo $DISK
 echo $PART_NUM

 # encrypt the btrfs volume:
 cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size $KEYSLOT_SIZE $DEV_ROOT

 # resize the partition to use all available space:
 parted --script /dev/$DISK resizepart $PART_NUM 100%

 # open the encrypted volume, will create a mapping as /dev/mapper/<name> where
 # <name> is the last parameter of the "cryptsetup open" command:
 cryptsetup open $DEV_ROOT root


 # mount btrfs-root and enlarge it to the new partition size resized above:
 mount /dev/mapper/root $MP_BTRFS
 btrfs filesystem resize max $MP_BTRFS

 # mount OS-root (subvol "@") from encrypted btrfs:
 mount /dev/mapper/root -o subvol=@ $MP_ROOT

 # identify UUID of btrfs root volume block device, store in crypttab:
 UUID_ROOT=$(blkid --output export $DEV_ROOT| grep ^UUID=)
 echo "root $UUID_ROOT none luks,discard" > $MP_ROOT/etc/crypttab

 # update target fstab with new mounts:
 sed --in-place \
    's#^.* / btrfs defaults 0 1$#/dev/mapper/root / btrfs defaults,subvol=@ 0 1#' \
    $MP_ROOT/etc/fstab
 echo "/dev/mapper/root /home btrfs defaults,subvol=@home 0 0" >> $MP_ROOT/etc/fstab
 # NOTE: the last digit in an fstab line is "fs_passno", defining the priority
 # during an fsck run - official btrfs documentation recommends to set this to 0!


 # mount required stuff for chroot:
 mount -t proc proc $MP_ROOT/proc
 mount -t sysfs sys $MP_ROOT/sys
 mount --bind /dev $MP_ROOT/dev
 mount --bind /run $MP_ROOT/run
 mount $DEV_BOOT $MP_ROOT/boot
 mount $DEV_EFI $MP_ROOT/boot/efi

 # update grub and install the required cryptsetup package:
 chroot $MP_ROOT update-grub
 chroot $MP_ROOT apt install -y cryptsetup-initramfs


 # create additional subvolumes for /tmp, /var/cache and swap:
 btrfs subvolume create $MP_BTRFS/@swap
 btrfs subvolume create $MP_BTRFS/@cache
 btrfs subvolume create $MP_BTRFS/@tmp
 btrfs subvolume list $MP_BTRFS

 # move existing file from /var/cache to @cache subvol:
 mv $MP_ROOT/var/cache/* $MP_BTRFS/@cache/

 # create a swapfile on the @swap subvol:
 btrfs filesystem mkswapfile --size 32G $MP_BTRFS/@swap/swapfile
 mkdir $MP_ROOT/swap

 # add subvols / swap to fstab:
 echo "
 /dev/mapper/root   /tmp         btrfs   defaults,subvol=@tmp   0 0
 /dev/mapper/root   /var/cache   btrfs   defaults,subvol=@cache   0 0
 /dev/mapper/root   /swap        btrfs   defaults,subvol=@swap   0 0
 /swap/swapfile     none         swap    sw   0 0
 " >> $MP_ROOT/etc/fstab

 # NOTE: probably using device UUIDs instead of /dev/mapper/xx paths would be a
 # good idea as they'd be independent of mapper names!
	#!/bin/sh

	set -e

	MP_BTRFS=/mnt/btrfs
	MP_ROOT=/mnt/root
	MP_HOME=/mnt/home

	KEYSLOT_SIZE=32m

	DEV_ROOT=/dev/nvme0n1p3
	DEV_BOOT=/dev/nvme0n1p1
	DEV_EFI=/dev/nvme0n1p2

	# cleanup leftover mounts from installer:
	umount --quiet /target/boot/efi
	umount --quiet /target/boot
	umount --quiet /target/cdrom
	umount --quiet /target

	# create mountpoints
	mkdir -pv $MP_BTRFS
	mkdir -pv $MP_ROOT
	mkdir -pv $MP_HOME

	# create subvolumes
	mount $DEV_ROOT $MP_ROOT
	cd $MP_ROOT

	# create a snapshot "@" from current btrfs, will become the new "/" mount later:
	btrfs subvolume snapshot . @
	# create @home subvol
	btrfs subvolume create @home

	# re-mount "bare" btrfs, root and home subvolumes:
	umount $MP_ROOT
	mount $DEV_ROOT $MP_BTRFS
	mount $DEV_ROOT -o subvol=@ $MP_ROOT
	mount $DEV_ROOT -o subvol=@home $MP_HOME

	# move home dirs from @ subvol to @home:
	mv $MP_ROOT/home/* $MP_HOME/

	# delete everything but the subvolumes from the btrfs-root:
	find $MP_BTRFS -maxdepth 1 \! -name "@*" \! -name . -exec rm -Rf {} \;

	# make space for the key slot
	btrfs filesystem resize -$KEYSLOT_SIZE $MP_ROOT

	umount $MP_ROOT
	umount $MP_HOME
	umount $MP_BTRFS

	# identify disk and partition number:
	DISK=$(lsblk --noheadings --output pkname $DEV_ROOT)
	PART_NUM=$(lsblk --noheadings --output partn $DEV_ROOT \| tr -d "[:space:]")
	echo $DISK
	echo $PART_NUM

	# encrypt the btrfs volume:
	cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size $KEYSLOT_SIZE $DEV_ROOT

	# resize the partition to use all available space:
	parted --script /dev/$DISK resizepart $PART_NUM 100%

	# open the encrypted volume, will create a mapping as /dev/mapper/<name> where
	# <name> is the last parameter of the "cryptsetup open" command:
	cryptsetup open $DEV_ROOT root


	# mount btrfs-root and enlarge it to the new partition size resized above:
	mount /dev/mapper/root $MP_BTRFS
	btrfs filesystem resize max $MP_BTRFS

	# mount OS-root (subvol "@") from encrypted btrfs:
	mount /dev/mapper/root -o subvol=@ $MP_ROOT

	# identify UUID of btrfs root volume block device, store in crypttab:
	UUID_ROOT=$(blkid --output export $DEV_ROOT\| grep ^UUID=)
	echo "root $UUID_ROOT none luks,discard" > $MP_ROOT/etc/crypttab

	# update target fstab with new mounts:
	sed --in-place \
	's#^.* / btrfs defaults 0 1$#/dev/mapper/root / btrfs defaults,subvol=@ 0 1#' \
	$MP_ROOT/etc/fstab
	echo "/dev/mapper/root /home btrfs defaults,subvol=@home 0 0" >> $MP_ROOT/etc/fstab
	# NOTE: the last digit in an fstab line is "fs_passno", defining the priority
	# during an fsck run - official btrfs documentation recommends to set this to 0!


	# mount required stuff for chroot:
	mount -t proc proc $MP_ROOT/proc
	mount -t sysfs sys $MP_ROOT/sys
	mount --bind /dev $MP_ROOT/dev
	mount --bind /run $MP_ROOT/run
	mount $DEV_BOOT $MP_ROOT/boot
	mount $DEV_EFI $MP_ROOT/boot/efi

	# update grub and install the required cryptsetup package:
	chroot $MP_ROOT update-grub
	chroot $MP_ROOT apt install -y cryptsetup-initramfs


	# create additional subvolumes for /tmp, /var/cache and swap:
	btrfs subvolume create $MP_BTRFS/@swap
	btrfs subvolume create $MP_BTRFS/@cache
	btrfs subvolume create $MP_BTRFS/@tmp
	btrfs subvolume list $MP_BTRFS

	# move existing file from /var/cache to @cache subvol:
	mv $MP_ROOT/var/cache/* $MP_BTRFS/@cache/

	# create a swapfile on the @swap subvol:
	btrfs filesystem mkswapfile --size 32G $MP_BTRFS/@swap/swapfile
	mkdir $MP_ROOT/swap

	# add subvols / swap to fstab:
	echo "
	/dev/mapper/root /tmp btrfs defaults,subvol=@tmp 0 0
	/dev/mapper/root /var/cache btrfs defaults,subvol=@cache 0 0
	/dev/mapper/root /swap btrfs defaults,subvol=@swap 0 0
	/swap/swapfile none swap sw 0 0
	" >> $MP_ROOT/etc/fstab

	# NOTE: probably using device UUIDs instead of /dev/mapper/xx paths would be a
	# good idea as they'd be independent of mapper names!
No results found