ArchLinux self-decrypting server keygen hook

archlinux-initcpio-keygen-hook.sh

HOOKS="... keygen encrypt ..."

# /etc/initcpio/hooks/keygen

LUKS="/dev/sdxy"

run_hook() {
    # Produce key without newlines.
    echo -n $(
        (
            cat /sys/class/net/*/address
            tail /proc/iomem
            grep -vE '(MHz|bogomips)' /proc/cpuinfo
            grep -v sr0 /proc/partitions
            cat /root/secret
        ) | sha512sum
    ) > /crypto_keyfile.bin

    # Reset key. (if applicable)
    # TODO: Find a stable alternative to /proc/iomem
    echo -n $(sha512sum /root/secret) | cryptsetup --iter-time=5000 luksChangeKey /dev/"$LUKS" /crypto_keyfile.bin
}

# /etc/initcpio/install/keygen

build() {
    add_file "/root/secret"
    add_runscript
}

help() {
    cat <<HELPEOF
Self-Decrypting Server
https://wiki.gentoo.org/wiki/Custom_Initramfs/Examples#Self-Decrypting_Server
HELPEOF
}

# reset-passphrase.sh

LUKS="/dev/sdxy"

cryptsetup luksAddKey /dev/"$LUKS" <(echo -n $(sha512sum /root/secret))
cryptsetup luksKillSlot /dev/"$LUKS" 0

# generate-secret.sh

dd if=/dev/urandom of=/root/secret count=64