SELECT
‘#bicycle 🚴♂️’
,‘#databases’
,‘#sql’
,‘#selfhosting’
,‘#Linux 🐧’
,‘Team vi’
,‘#mdRzA’
,‘Generation X’
FROM life
WHERE 0 = 0
;
@Hercules So it was possible to use one of the other keyslots to open the encryption?
Probably you can test your wanted configuration in a virtual machine with some small virtual drives to avoid any loss of data.
I found it relative difficult to find the correct UUID which had to be used when I setup my system in the past.
@Hercules My exampled assumed, that you only have a password set on keyslot 0.
LUKS keyslots are starting at 0, so it seems, that you deleted the initial set password.
I hope, you know the other keyslots.
As far I can see, you can specify, which keyslot has to be selected for unlocking the volume key.
More information you can find in the man page.
man cryptsetup-luksaddkey
cryptsetup luksAddKey /dev/md0 --new-key-slot 0 --key-slot 1
@Hercules I created it on my own, because I have some keys for other devices, too.
But you can place it, where you want.
But with crypttab.d I have a simple connection to crypttab configuration file.
Another way can be pam_mount, which I’m using on an SBC for opening an encrypted device:
https://inai.de/projects/pam/_mount/
@Hercules I have a similar setup with RAID1 and BTRFS.
I’m using a keyfile for that:
dd bs=512 count=4 if=/dev/random of=/etc/crypttab.d/keyfile-data.bin iflag=fullblock
chmod 600 /etc/crypttab.d/keyfile-data.bin
cryptsetup luksAddKey /dev/mapper/raid /etc/crypttab.d/keyfile-data.bin --new-key-slot 1
entry in /etc/crypttab:
data UUID=<blkid from /dev/md0> /etc/crypttab.d/keyfile-data.bin luks
entry in /etc/fstab:
UUID=<blkid from /dev/mapper/raid> /mnt/data …
@rtxn Maybe you find the reason in the chapter for Bridged Networking.
https://www.virtualbox.org/manual/ch06.html#network_bridged
With bridged networking, Oracle VM VirtualBox uses a device driver on your host system that filters data from your physical network adapter. This driver is therefore called a net filter driver. This enables Oracle VM VirtualBox to intercept data from the physical network and inject data into it, effectively creating a new network interface in software.
@rtxn I’m no expert in networking with VirtualBox, but did you already had a look into the manual?
https://www.virtualbox.org/manual/ch06.html#network_udp_tunnel
[Container]
AutoUpdate=registry
ContainerName=con-portainer
HostName=con-portainer
Image=docker.io/portainer/portainer-ce:lts
Notify=conmon
PublishPort=8000:8000
PublishPort=9443:9443
Pull=missing
Volume=vol-portainer:/data
Volume=%t/podman/podman.sock:%t/podman/podman.sock
[Unit]
Description=Container running Portainer container management platform
Wants=podman-user-wait-network-online.service
After=podman-user-wait-network-online.service
After=local-fs.target
Requires=podman.socket
@Excaliburr Yes, you are right.
Do you have already a single container running with rootless podman?
Your given Arr-Stack seems to me relative complex when you are a beginner with podman.
Probably you could get some experience, when you start with just a single container.
In following posts are my personal quadlet settings for running Portainer, which could be helpful for getting insights of your running containers.
https://docs.portainer.io/start/install-ce/server/podman/linux
Maybe you have to check Volume and Port settings, so that it fit your needs.
I always prefix my containers with “con-”, so that it is easier to finding them with systemctl --user.
[Install]
\# Start by default on boot without explicit enabling
\# To avoid automatic start Install section has to be
\# disabled
WantedBy=default.target multi-user.target
[Service]
\# Restart service in case of failures
Restart=on-failure
TimeoutStartSec=20
TimeoutStopSec=20
Type=notify
@Excaliburr 3. Are we talking here about rootless podman? If yes, containers are running on the host with the uid of current user, in your example with UID 1000.
Processes IN started containers are often running with UID=0, but this belongs to definition of used container and is only IN container.
PostgreSQL in Debian container is running with UID=999.
To avoid problems with created files in host file system, I’m using UserNS=keep-id:uid=999,gid=999, which maps files to the UID on host system.
@Nighed Sorry, but I currently don’t use Opencloud and I don’t have insights in the code.
But maybe the code itself has an answer for your question.
https://github.com/opencloud-eu
@mjr I think, you are writing about Owncloud.
Opencloud is newly written with Go, so it can’t be a fork of PHP driven Owncloud or Nextcloud.
Probably https://opencloud.eu/ could be an alternative.
@theorangeninja I would suggest again, that you try to access the content of the podman volume as host user, which is running the podman container.
I think, that it would looks like this and that you can only access it using podman unshare:
drwxr-xr-x 1 166446 166446 66 28. Jul 20:43 \_data
@theorangeninja Did you have tried a ls -al on the used volume?
The podman volume path can be found here:
`podman info --format ‘{{.Store.VolumePath}}’``
When you use $HOME/linkding as volume mount and the linkding container process is running with <> UID 0, then the created files are belonging to another UID than your UID.
Maybe this tutorial explains it better:
https://www.tutorialworks.com/podman-rootless-volumes/
@theorangeninja Rootless podman container and owner of created files - always a mystery.
Maybe, the part belonging to “Using volumes” could help:
https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md
If the container process is running with another UID than 0 (root), created files on the host belongs to another UID, calculated based on settings from /etc/suduid.
You should have a look into --userns for mapping of UIDs between container and host:
https://docs.podman.io/en/latest/markdown/podman-run.1.html
For PostgreSQL I’m using keep-id:uid=999,gid=999.
@Hercules That was really luck. I hope, that your backup will be successful.
Until now I didn’t used it, but probably I will also have a deeper look into luksHeaderBackup.
https://man.archlinux.org/man/cryptsetup-luksHeaderBackup.8.en
https://man.archlinux.org/man/cryptsetup-luksHeaderRestore.8.en