Shinyspace

Edit

Debian boot on encrypted root

2026-06-18

Today i've decided to try what a minimal debian install looks like. First challenge: get it to boot from an encrypted root, but without GRUB.

since we don't have archlinux' nice mkinitcpio (actually maybe i should have checked lol), we use systemd-ukify and related utilities.

Basic overview:

unencrypted EFI partition
LUKS encrypted root partition
UKI on the standard path on the EFI part
usb stick with keyfile plugged in at boot

it mostly works similar to arch, but i had the following issues:

usb stick with "vfat" filesystem didn't mount. i added these modules to /etc/initramfs-tools/modules:

vfat
fat
nls_cp437
nls_iso8859_1
nls_utf8
nls_ascii

kernel parameters pointing at what to unlock and where the keyfile is didn't work. i'm not sure here if i used the sd-encrypt hook, the encrypt hook or something else entirely on debian.

I switched to a crypttab file and that worked (once i removed the kernel cmdline params):

cryptroot UUID=someuuid /mnt/usbkey/keyfile luks,initramfs

i'm not sure if it was actually necessary, but before removing the kernel params, the USB stick did not get mounted properly. for that, an LLM gave me the following solution:

create a mount script at /etc/initramfs-tools/scripts/local-top/aa_mount_usb make it executable

content:

#!/bin/sh
PREREQ=""
prereqs() {
    echo "$PREREQ"
}
case $1 in
prereqs)
    prereqs
    exit 0
    ;;
esac

. /scripts/functions

# Configuration
USB_UUID="your-partitions-uuid-here"
MNT_POINT="/mnt/usbkey"

# Wait for the device to appear
echo "Waiting for USB key device (UUID=$USB_UUID)..."
for i in $(seq 1 15); do
    if [ -b "/dev/disk/by-uuid/$USB_UUID" ]; then
        break
    fi
    sleep 1
done

if [ ! -b "/dev/disk/by-uuid/$USB_UUID" ]; then
    echo "USB key not found after 15 seconds. Falling back to interactive prompt."
    exit 0
fi

# Mount the USB stick
mkdir -p "$MNT_POINT"
echo "Mounting USB key..."
mount -t vfat "/dev/disk/by-uuid/$USB_UUID" "$MNT_POINT"

exit 0

and with that it worked!