• 3 Posts
  • 22 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
  • More of a debugging step, but have you tried running lsinitrd on the initramfs afterwards to verify your script actually got added?

    You theoretically could decompress the entire image to look around as well. I don’t know the specifics for alpine, but presumably there would be a file present somewhere that should be calling your custom script.

    EDIT: Could it also be failing because the folder you are trying to mount to does not exist? Don’t you need a mkdir somewhere in your script?



  • Doubling what Klaymore said, I’ve seen this “just work” as long as all partitions have the same password, no key files necessary.

    That said, if you needed to use a key file for some reason, that should work too, especially if your root directory is one big partition. Keep in mind too that the luks commands for creating a password-based encrypted partition vs a keyfile-based encrypted partition are different, so you can’t, for example, put your plaintext password into a file and expect that to unlock a LUKS partition that was setup with a password.

    But the kernel should be trying to mount your root partition first at boot time where it will prompt for the password. After that it would look to any /etc/crypttab entries for information about unlocking the other partitions. In that file you can provide a path to your key file, and as long as it’s on the same partition as the crypttab it should be able to unlock any other partitions you have at boot time.

    It is also possible, as one of your links shows, to automatically unlock even the root partition by putting a key file and custom /etc/crypttab into your initramfs (first thing mounted at boot time), but it’s not secure to do so since the initramfs isn’t (and can’t be) encrypted - it’s kind of the digital equivalent of hiding the house key under the door mat.






  • Maybe I am not thinking of the access control capability of VLANs correctly (I am thinking in terms of port based iptables: port X has only incoming+established and no outgoing for example).

    I think of it like this: grouping several physical switch ports together into a private network, effectively like each group of ports is it’s own isolated switch. I assume there are routers which allows you to assign vlans to different Wi-Fi access points as well, so it doesn’t need to be literally physical.

    Obviously the benefits of vlans over something actually physical is that you can have as many as you like, and there are ways to trunk the data if one client needs access to multiple vlans at once.

    In your setup, you may or may not benefit, organizationally. Obviously other commenters have pointed out some of the security benefits. If you were using vlans I think you’d have at a minimum a private and public vlan, separating out the items that don’t need Internet access from the Internet at all. Your server would probably need access to both vlans in that scenario. But certainly as you say, you can probably accomplish a lot of this without vlans, if you can aggressively setup your firewall rules. The benefit of vlans is you would only really need to setup firewall rules on whatever vlan(s) have Internet access.





  • To add on to this answer (which is correct):

    Your “of” can also just be a regular file if that’s easier to work with vs needing to create a new partition for the copy.

    I’ll also say you might want to use the block size parameter “bs=” on “dd” to speed things up, especially if you are using fast storage. Using “dd” with “bs=1G” will speed things up tremendously if you have at least >1GB of RAM.


  • To expand on this a bit, git pull under the hood is basically a shortcut for git fetch (get the remote repository’s state) and git merge origin/main main (merge to remote changes to your local branch, which for you is always main).

    When you have no local changes, this process just “makes a line” in your commit history (see git log --graph --decorate), but when you have local changes and the remote has changed too, it has to put those together into a merge commit - think a diamond shape with the common ancestor at the bottom, the remote changes on one side, your changes on the other side, and the merge of the two at the top.

    Like the above comment says, normally this process is clarified at the command line - VSCode must be handling it automatically if there are no code conflicts.



  • I saw this complaint in another post online (paraphrased):

    The screen and use of a Pi seem at odds with each other. The screen is ultra-low power, but there are of course huge drawbacks for usability. Meanwhile the CPU is very powerful, but chews through, comparatively, a lot of power quickly.

    They argued that it would be better to either pair the Pi with a better screen for a more powerful/usable handheld, or go all in on longevity and use some kind of low-power chip to pair with the screen for a terminal that could last for days.

    … I’ve got to say, it’s a fair point. A low power hand-held that could run Linux and run for days would be pretty cool, even if it was underpowered compared to a Pi. No idea what you could use for such a thing though.