Please unlock the host manually

[dodgeandchase]

hi, i need to automate the reboot for the luks encrypted servers and i dont want a human intervention to enter the password when prompted with the please enter password. however this collection doesnt seem to work. can confirm this is able to enter password without human intervention?

[applejag]

Hello @dodgeandchase! Yes this project aims to solve that use case.

This project is quite young, and because of its nature it can be tricky to have automated tests for to prove it to you.

This was in a working state before, but after some regressions, it stopped working in some cases.

We have it in our backlog to fix this (in our internal Jira), but due to other tasks taking priority, this project has been put on ice for the moment.

The two bugs we're currently aware of:

• initramfs_network role: Handler "Extract downloaded tarball" fails
• reboot_luks_ssh action plugin: Timeouts and errors too early

I do not have a time estimate of when this will be fixed, except that it won't be fixed in the near future.

[Ben7on]

Hello @dodgeandchase,

I believe I made the necessary changes to fix the reboot plugin. I made a pull request, feel free to try it and report back with any issues.

I'm not sure if it will work when providing the key as a string, I only tested the code with the following parameters:

  luks_password: "{{ disk_encrypt_password }}"
  luks_ssh_private_key_file: "{{ dropbear_key_path }}"
  luks_ssh_port: "{{dropbear_port}}"

It is necessary to have dropbear force the unlock using the following option:

DROPBEAR_OPTIONS="-c cryptroot-unlock"

You can work around this by providing the following string as decryption password:

luks_password: 'echo -n "{{ disk_encrypt_password }}" | cryptroot-unlock'