Ubuntu full disk encryption - hetzner

instructions.md

1. Copy the ssh key: cp .ssh/authorized_keys /tmp/authorized_keys
2. Create the config file
3. Create post-install script
4. Start the installation: installimage -a -c /tmp/setup.conf -x /tmp/post-install.sh
5. Reboot and unlock

References:

1. https://community.hetzner.com/tutorials/install-ubuntu-2004-with-full-disk-encryption

post-install.sh

#!/bin/bash


add_rfc3442_hook() {
  cat << EOF > /etc/initramfs-tools/hooks/add-rfc3442-dhclient-hook
#!/bin/sh

PREREQ=""

prereqs()
{
        echo "\$PREREQ"
}

case \$1 in
prereqs)
        prereqs
        exit 0
        ;;
esac

if [ ! -x /sbin/dhclient ]; then
        exit 0
fi

. /usr/share/initramfs-tools/scripts/functions
. /usr/share/initramfs-tools/hook-functions

mkdir -p \$DESTDIR/etc/dhcp/dhclient-exit-hooks.d/
cp -a /etc/dhcp/dhclient-exit-hooks.d/rfc3442-classless-routes \$DESTDIR/etc/dhcp/dhclient-exit-hooks.d/
EOF

  chmod +x /etc/initramfs-tools/hooks/add-rfc3442-dhclient-hook
}


# Install hook
add_rfc3442_hook

# Copy SSH keys for dropbear
mkdir -p /etc/dropbear-initramfs
cp -a /root/.ssh/authorized_keys /etc/dropbear-initramfs/authorized_keys

# Update system
apt-get update >/dev/null
apt-get -y install cryptsetup-initramfs dropbear-initramfs

setup.conf

CRYPTPASSWORD secret
DRIVE1 /dev/sda
BOOTLOADER grub
HOSTNAME host.example.com
PART /boot ext4 1G
PART /     ext4 all crypt
IMAGE /root/images/Debian-1101-bullseye-amd64-base.tar.gz
SSHKEYS_URL /tmp/authorized_keys