Rubenerd

I had one of my other HP Microservers brought back from the office last week to help with this working-from-home world we’re in right now. I was going to wipe an old version of Debian Wheezy/Xen and install FreeBSD to mirror my other machines before thinking: why not NetBSD?

For people on Twitter asking why I’d want to, I discussed where I use NetBSD in a post back in December, along with the below wallpaper that’s become a running joke here! Some people were polite when asking, others… weren’t so much. That’s a heavier topic for another post.

But I digress: this in the NetBSD 9.0 release notes that had me most excited:

Updated ZFS. This is the first release with ZFS usable for daily use

This is huge! ZFS is the only file system I trust with data I care about, so to have that confidence along with a familiar and flexible toolchain on NetBSD is too cool. Of course I had to try it.

Setting up encryption

On FreeBSD I use GELI to provide encrypted devices to build my zpools on. I didn’t have experience with doing this on NetBSD, but some reading of their always excellent documentation showed I could use the cryptographic device driver cgd(4), and its cgdconfig(8) interface.

My Microserver had two 4.0 TB SATA drives, wd0 and wd1. So the first step was to create cgd configuration files for these and back them up:

# cgdconfig -g -o /etc/cgd/wd0 aes-xts 256
# cgdconfig -g -o /etc/cgd/wd1 aes-xts 256

Then I needed to set passphrases. You can use the re-enter verification option so you know you’ve typed the passwords correctly.

# cgdconfig -V re-enter cgd0 /dev/wd0
# cgdconfig -V re-enter cgd1 /dev/wd1

Unmounting and mounting them again with my password confirmed they’d been configured correctly:

# cgdconfig -u /dev/cgd0
# cgdconfig -u /dev/cgd1
# cgdconfig cgd0 /dev/wd0
# cgdconfig cgd1 /dev/wd1

Avoiding making puns about jumping into pools

Now I had cgd0 and cgd1, which would broadly correspond to ada0.eli and ada1.eli in FreeBSD with GELI, for example. Which means setting up a basic ZFS pool is as easy as this:

# zpool create tank mirror /dev/cgd0 /dev/cgd1

And sure enough, there it is: an encrypted ZFS pool on NetBSD! How friggen awesome is that!?

# zpool status
  pool: tank
 state: ONLINE
  scan: none requested
config:
    
        NAME        STATE     READ WRITE CKSUM
        tankaino0   ONLINE       0     0     0
          mirror-0  ONLINE       0     0     0
            cgd0    ONLINE       0     0     0
            cgd1    ONLINE       0     0     0

The next steps will be to research if I can (or should!) do ZFS send/receive with my FreeBSD ZFS boxes, what the performance delta is between them, and what parts of NetBSD are well suited for snapshotting, like my pkgsrc tree.

Disclaimers

In production you should create a partition layout with gpt(8) or fdisk(8), and a NetBSD cgd partition first before running the above. This would be equivalent to running gpart on FreeBSD rather just running GELI against a blank disk. It’s good for so many practical reasons to label disks, but also because NetBSD’s cgdconfig can be told to verify drive layouts like disklabels, gpt, etc.

Cryptography is critical to get right, or it’s not worth doing. Read and follow the official documentation, this post should only be treated as the fun proof of concept that it was.