Should I use TrueNas or Debian + ZFS?

TrueNAS General
41

I dont understand what you actually want to say with this.

As far as I understand the boot-pool of truenas is always unencrypted. This means that a truenas system can always boot the operating system up to the GUI. It then reads the encryption keys from the truenas database and unlocks all encrypted datasets. This all happens without user interaction.

The problem arises when you do not want that truenas stores the encryption keys in the truenas database on the boot-pool because you think that this is not as secure as you want it.

Then you have two options:

  1. Use a password prompt instead of a key file.This would need a user interaction to unlock the encrypted datasets after boot.

  2. Store the keys in a remote location and retrieve the keys during boot with commands like curl, wget, scp, etc. But this is currently not possible with truenas.

42

I do believe it is somewhat possible with post-init script. Didnā€™t try it, though.

43

i suspect itā€™s along the lines of ā€˜thereā€™s no point having a mirrored boot pool if it wonā€™t fail over successfully on a failed diskā€. Nothing to do with encryption of the boot pool.

That, I believe, was the premise behind a lingering example on the forum of a mirror pair of boot devices mirrored again with a third boot device not on the same controller as the mirror, to get bios boot order failover if the first controller didnā€™t play nicely.