https://kohanyi.net/tags/clevis/Recent content in Clevis on Kohanyi NewsHugoen-us<a href="https://creativecommons.org/licenses/by-sa/4.0/" target="_blank" rel="noopener">CC BY-SA 4.0</a>Wed, 19 Aug 2026 09:30:00 +0000https://kohanyi.net/posts/2026/08/debian-with-encrypted-root-and-automatic-unlock-via-tang--clevis/Wed, 19 Aug 2026 09:30:00 +0000https://kohanyi.net/posts/2026/08/debian-with-encrypted-root-and-automatic-unlock-via-tang--clevis/<p>A recipe for installing Debian with a LUKS-encrypted root filesystem and configuring it to unlock automatically at boot using Tang and Clevis (Network-Bound Disk Encryption).</p> <blockquote> <p><strong>Disclaimer:</strong> This process will nuke all data on the drives you target. Back up anything you want to keep before you start.</p> </blockquote> <p>This works on plain ext4 on LUKS (Part 1 below) and on <a href="https://kohanyi.net/posts/2026/08/debian-13-with-encrypted-zfs-root-zfs-on-luks/">ZFS on LUKS</a> equally &ndash; Clevis binds to the LUKS layer regardless of what is on top.</p>