ZFS
Decisions
- While encrypting the pool volume is possible, I decided to go with a sub-volume, just in case I need to add un-encrypted data later
- The options for encryption keys passphrase, raw key, and hex key. I'll be using a hex key for ease of backup in my password database.
- When creating the pool use the entire disk, not partitions where possible
- When creating the pool, use /dev/disk/by-id, not /dev/sda, as these can change on boot
Links
- ZFS - ArchWiki
- Performance tuning - OpenZFS
Create the pool
zpool create datapool mirror /dev/disk/by-id/disk1 /dev/disk/by-id/disk2
Creating the Volume
- Generate the key
mkdir /etc/zfs/keys
chmod 700 /etc/zfs/keys
openssl rand -hex -out /etc/zfs/keys/datasetname 32
chmod 700 /etc/zfs/keys/datasetname
- Create
the pool, and subsequent datasetdatasets
## Encrypted
zfs create -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///etc/zfs/keys/datasetname poolname/datasetname
## Compressed
zfs create -o compression=lz4 poolname/datasetname