cryptpv.sh

#!/usr/bin/env bash

set -xeuo pipefail

DISK="${1}"
_DISKNAME="$(basename "${DISK}")"

openssl rand 4096 >"${_DISKNAME}.key"

yes YES | cryptsetup luksFormat -d "${_DISKNAME}.key" "${DISK}" || true
cryptsetup luksOpen -d "${_DISKNAME}.key" "${DISK}" "${_DISKNAME}"

pvcreate "/dev/mapper/${_DISKNAME}"
vgcreate "${_DISKNAME}-vg" "/dev/mapper/${_DISKNAME}"
lvcreate -l 99%FREE -n "${_DISKNAME}-crypt" "${_DISKNAME}-vg"

printf '%s %s %s luks,discard,lvm=%s\n' "${_DISKNAME}" "${DISK}" "$(realpath "${_DISKNAME}".key)" "${_DISKNAME}" | tee -a /etc/crypttab

luks-lvm-notboot.md

LVM autoinit on boot for LUKS disk

openssl rand 4096 > sdc.key
cryptsetup luksFormat -d sdc.key /dev/sdc
cryptsetup luksOpen -d sdc.key /dev/sdc sdc
pvcreate /dev/mapper/sdc 
vgcreate sdc-vg /dev/mapper/sdc
lvcreate -l 99%FREE -n sdc2T sdc-vg
printf 'sdc /dev/sdc /root/sdc.key luks,discard,lvm=sdc\n' >> /etc/crypttab

convert to thinpool for PVE

lvconvert --type thin-pool vgname/lvname