{"id":18878826,"url":"https://github.com/rwanyoike/mkinitcpio-remote-cryptroot","last_synced_at":"2026-05-16T22:06:04.561Z","repository":{"id":72150734,"uuid":"271000069","full_name":"rwanyoike/mkinitcpio-remote-cryptroot","owner":"rwanyoike","description":"🔐 A systemd init (systemd hook) based implementation for booting a LUKS-encrypted system remotely","archived":false,"fork":false,"pushed_at":"2024-10-07T18:48:02.000Z","size":17,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-07-28T17:45:02.209Z","etag":null,"topics":["archlinux","cryptroot","encryption","luks","mkinitcpio","ssh","systemd"],"latest_commit_sha":null,"homepage":"https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_of_the_root_(or_other)_partition","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rwanyoike.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-06-09T12:44:55.000Z","updated_at":"2023-08-10T17:21:49.000Z","dependencies_parsed_at":null,"dependency_job_id":"d76343ce-285a-40d5-918c-6871ebf7ed9d","html_url":"https://github.com/rwanyoike/mkinitcpio-remote-cryptroot","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/rwanyoike/mkinitcpio-remote-cryptroot","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rwanyoike%2Fmkinitcpio-remote-cryptroot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rwanyoike%2Fmkinitcpio-remote-cryptroot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rwanyoike%2Fmkinitcpio-remote-cryptroot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rwanyoike%2Fmkinitcpio-remote-cryptroot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rwanyoike","download_url":"https://codeload.github.com/rwanyoike/mkinitcpio-remote-cryptroot/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rwanyoike%2Fmkinitcpio-remote-cryptroot/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33120456,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-16T18:38:32.183Z","status":"ssl_error","status_checked_at":"2026-05-16T18:38:29.903Z","response_time":115,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["archlinux","cryptroot","encryption","luks","mkinitcpio","ssh","systemd"],"created_at":"2024-11-08T06:30:19.295Z","updated_at":"2026-05-16T22:06:04.545Z","avatar_url":"https://github.com/rwanyoike.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mkinitcpio-remote-cryptroot\n\n\u003e `systemd-networkd` + `tinysshd` + `systemd-tty-ask-password-agent`\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"assets/logo-dark.png\" style=\"max-width: 100%;\" alt=\"Arch Linux\"\u003e\n\u003c/p\u003e\n\n\\[**Arch Linux**\\] If you want to be able to [boot a fully LUKS-encrypted system remotely](https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_of_the_root_(or_other)_partition), you will need a way to enter a passphrase for the root partition/volume at startup. This can be achieved by running a set of `mkinitcpio` hooks that configure a network interface, ssh access, and a password agent in initramfs.\n\n```shell\n$ ssh root@\u003cremote host\u003e\n🔐 Please enter passphrase for disk cryptroot: (press TAB for no echo)\n```\n\nWorks as of `systemd 245 (245.6-7-arch)`\n\n## Example\n\nExample `/etc/mkinitcpio.conf`:\n\n```ini\nHOOKS=(base autodetect modconf block filesystems keyboard fsck systemd sd-encrypt network tinyssh password-agent)\n```\n\n## Hooks\n\n### systemd (owned by the `systemd` package)\n\nSee: [https://wiki.archlinux.org/index.php/Mkinitcpio#Common_hooks](https://wiki.archlinux.org/index.php/Mkinitcpio#Common_hooks)\n\nThis hook triggers a systemd based init, which does not run any runtime hooks but uses systemd units instead.\n\n### sd-encrypt (owned by the `cryptsetup` package)\n\nSee: [https://wiki.archlinux.org/index.php/Mkinitcpio#Common_hooks](https://wiki.archlinux.org/index.php/Mkinitcpio#Common_hooks)\n\nThis hook allows for an encrypted root device with systemd initramfs.\n\n**Recommend:** That you set a root [device timeout kernel parameter](https://wiki.archlinux.org/index.php/dm-crypt/System_configuration#Timeout):\n\n```shell\nrootflags=x-systemd.device-timeout=0\n```\n\n### network\n\nThis hook sets up the `systemd-networkd.service` systemd service and copies over any `*.initramfs` files in `/etc/systemd/network`.\n\nExample:\n\n```ini\n# /etc/systemd/network/wired.network.initramfs\n\n[Match]\nName=*\n\n[Network]\nDHCP=yes\n```\n\n### tinyssh\n\nThis hook sets up the `initrd-tinyssh.service` systemd service, converts the openssh ed25519 host key to binary format for TinySSH, and copies over the authorized keys file at `/etc/tinyssh/root_key`.\n\nExample:\n\n```ini\n# /etc/tinyssh/root_key\n\nssh-ed25519 \u003cbase64-encoded key\u003e \u003ccomment\u003e\n```\n\n### password-agent\n\nThis hook adds the command `systemd-tty-ask-password-agent --query` to `/root/.profile` (for `sh` invocation).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frwanyoike%2Fmkinitcpio-remote-cryptroot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frwanyoike%2Fmkinitcpio-remote-cryptroot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frwanyoike%2Fmkinitcpio-remote-cryptroot/lists"}