User:2r/NixOS on ZFS: Difference between revisions
imported>2r No edit summary |
imported>2r No edit summary |
||
| Line 84: | Line 84: | ||
| container for datasets that need backup, such as /{root,home,home,user} | | container for datasets that need backup, such as /{root,home,home,user} | ||
|} | |} | ||
==== Encryption ==== | |||
Boot pool can be encrypted with LUKS1 to prevent initrd tempering, however ZFS on LUKS is discouraged on root pool as LUKS abstracts physical devices and thus not desirable. Also, data needs to be encrypted per disk, thus slower than per file, as with ZFS native encryption. | |||
ZFS native encryption does not encrypt dataset paths and default properties. Custom properties containing colon <code>custom:property</code> is encrypted. Also, as ZFS currently does not support replacing master key, once the passphrase/keyfile is compromised, the encrypted dataset must be destroyed to protect confidentiality. Therefore, users are advised to choose a strong password at the beginning. | |||