Encrypt-at-rest 2nd drive (cryptsetup)

Terminology

Term	What it is
Drive	Physical hardware: `/dev/nvme1n1`, `/dev/sda`
Partition	A subdivision of a drive: `/dev/nvme1n1p1`. A drive can also be used whole, without partitions (as in this setup).
Device	Kernel’s generic term for any block device — could be a drive, a partition, or a virtual one. `/dev/nvme1n1` and `/dev/mapper/personal` are both “devices”.
Container	LUKS-specific: the encrypted wrapper sitting on a device. `cryptsetup luksFormat` creates a container; `cryptsetup open` unlocks it and exposes the plaintext inside.
Volume	- In LUKS context, it usually means the unlocked device (`/dev/mapper/personal`), sometimes the container itself. - BTRFS uses the term for the whole filesystem.
Subvolume	BTRFS-internal: a named tree within a BTRFS volume (`@documents`, `@downloads`). Not a block device — managed entirely by BTRFS, mountable independently via `subvol=`.

Stack for this setup: drive (/dev/nvme1n1) → LUKS container (on the whole drive, but could be on a specific partition) → unlocked volume (/dev/mapper/personal) → BTRFS volume/filesystem → BTRFS subvolumes (@documents, @downloads).

Uses

# Umount then close/lock the encrypted container
sudo umount ~/Documents ~/Downloads /mnt/personal
sudo cryptsetup close personal
 
# Unlock the LUKS container
sudo cryptsetup open /dev/nvme1n1 personal # using passphrase, or:
sudo cryptsetup open /dev/nvme1n1 personal --key-file=/etc/luks-keys/personal.key
# Mount again
sudo mount -a # everything listed in fstab

# See all block devices, their encryption, uuid, etc.
lsblk -o NAME,MODEL,SIZE,FSTYPE,FSVER,UUID,MOUNTPOINTS,FSUSE%
 
# Check if encrypted device is open
sudo cryptsetup status personal
 
# List all open encrypted devices
sudo dmsetup ls --tree
 
# Show LUKS header info (key slots, cipher, etc)
sudo cryptsetup luksDump /dev/nvme1n1

Setup

Encryption and Keys

# Encrypt the entire drive, e.g. using same passphrase as system drive
sudo cryptsetup luksFormat --type luks2 /dev/nvme1n1

# Create a secure directory for key files
sudo mkdir -p /etc/luks-keys
sudo chmod 700 /etc/luks-keys
 
# Generate a random key file
sudo dd if=/dev/urandom of=/etc/luks-keys/personal.key bs=4096 count=1
sudo chmod 600 /etc/luks-keys/personal.key
 
# Add the key file to the LUKS container (so it can unlock with either passphrase OR key file)
sudo cryptsetup luksAddKey /dev/nvme1n1 /etc/luks-keys/personal.key

BTRFS Formatting and Subvolumes

# Unlock container
sudo cryptsetup open /dev/nvme1n1 personal --key-file=/etc/luks-keys/personal.key
 
# Create BTRFS filesystem on the unlocked volume
sudo mkfs.btrfs -L personal /dev/mapper/personal
 
# Mount temporarily to create BTRFS subvolumes
sudo mkdir -p /mnt/personal
sudo mount /dev/mapper/personal /mnt/personal
 
# Create subvolumes
sudo btrfs subvolume create /mnt/personal/@documents
sudo btrfs subvolume create /mnt/personal/@downloads
 
# Unmount
sudo umount /mnt/personal

Auto-decrypt and Auto-mount

lsblk -o NAME,UUID /dev/nvme1n1
 
# Add following line with extracted uuid to /etc/crypttab:
personal    UUID=<drive-uuid>    /etc/luks-keys/personal.key    luks

# Add to /etc/fstab:
/dev/mapper/personal    /mnt/personal    btrfs    subvolid=5,noatime,compress=zstd    0 0 # For admin tasks such as btrfs backups
/dev/mapper/personal    /home/<username>/Documents    btrfs    subvol=@documents,noatime,compress=zstd    0 0
/dev/mapper/personal    /home/<username>/Downloads    btrfs    subvol=@downloads,noatime,compress=zstd    0 0

Data Migration and Test

# Move existing data
mv ~/Documents ~/Documents-bak
mv ~/Downloads ~/Downloads-bak
 
# Mount everything
mkdir ~/Documents ~/Downloads
sudo mount -a
sudo chown $(whoami):$(whoami) ~/Documents ~/Downloads
 
mv ~/Documents-bak/* ~/Documents-bak/.* ~/Documents/
mv ~/Downloads-bak/* ~/Downloads-bak/.* ~/Downloads/
 
ls -alR ~/Documents-bak ~/Downloads-bak # Should be empty
rm -d ~/Documents-bak ~/Downloads-bak

sudo reboot # check auto-mount and auto-decrypt
 
lsblk -f
df -h | grep personal

Re-setup (existing encrypted volume)

For example after an OS re-install when the encrypted drive already exists and you have the personal.key file.

sudo mkdir -p /mnt/personal /etc/luks-keys && cd /etc/luks-keys
sudo chmod 700 .
sudo mv ~/Downloads/personal.key . # Download from 1password
sudo chmod 400 personal.key && sudo chown root:root personal.key
 
sudo cryptsetup open /dev/nvme1n1 personal --key-file=/etc/luks-keys/personal.key
sudo cryptsetup status personal
 
sudo mount /dev/mapper/personal /mnt/personal

Then the Auto-decrypt and Auto-mount section.

Finally Data Migration and Test or at least:

sudo mount -a
ls -al ~/Documents ~/Downloads # Check content and ownership

one137

Explorer