Debian with Encrypted Root and Automatic Unlock via Tang + Clevis

Wed, 19 Aug 2026 09:30:00 +0000

A recipe for installing Debian with a LUKS-encrypted root filesystem and configuring it to unlock automatically at boot using Tang and Clevis (Network-Bound Disk Encryption).

Disclaimer: This process will nuke all data on the drives you target. Back up anything you want to keep before you start.

This works on plain ext4 on LUKS (Part 1 below) and on ZFS on LUKS equally – Clevis binds to the LUKS layer regardless of what is on top.

Debian 13 with Encrypted ZFS Root (ZFS on LUKS)

Wed, 19 Aug 2026 09:00:00 +0000

A step-by-step recipe for installing Debian 13 (Trixie) with a fully encrypted root filesystem using ZFS on top of LUKS.

Disclaimer: This process will nuke all data on the drives you target. Back up anything you want to keep before you start.

This gives you the integrity and snapshot features of ZFS, with the whole disk encrypted at rest. I use this on my home servers and VPS instances.

Prerequisites

Debian 13 Live ISO (the standard live image, not the netinst)
Two disks for a mirror, or one disk if you are starting small
UEFI boot (recommended for modern systems)

Why not just ZFS native encryption?

ZFS native encryption (zencrypt) exists and works. But LUKS gives you a battle-tested crypto layer that GRUB, initramfs, and every Linux tool understand natively. Combined with ZFS on top, you get the best of both worlds.

Encryption on Kohanyi News

Debian with Encrypted Root and Automatic Unlock via Tang + Clevis

Debian 13 with Encrypted ZFS Root (ZFS on LUKS)

Prerequisites

Why not just ZFS native encryption?