Proxmox - Create a encrypted ZFS dataset for your LXC Container

Proxmox - Encrypted ZFS dataset for LXC Container

# Enalbe encryption for pool
zpool set feature@encryption=enabled poolName

# Create a encryption key
dd if=/dev/random bs=64 count=1 of=/.zfs-data.key

# Set the approprieate permission
chmod 400 /.zfs-data.key

# Make the key immutable
chattr +i /.zfs-data.key

# Create a new dataset with encryption enabled
zfs create -o encryption=on -o keylocation=file:///.zfs-data.key -o keyformat=raw poolName/private-data

# Create mountpoint to lxc for the new dataset with encryption
pct set 100 -mp5 /poolName/private-data,mp=/media/dataSetWithEncryption

# Copy zfs-load-key.service from here to '/etc/systemd/system/zfs-load-key.service'
vim /etc/systemd/system/zfs-load-key.service

# Enalbe zfs-load-key.service
systemctl enable zfs-load-key

zfs-load-key.service

[Unit]
Description=Load encryption keys
DefaultDependencies=no
After=zfs-import.target
Before=zfs-mount.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/zfs load-key -a

[Install]
WantedBy=zfs-mount.service