luks

Description

Puppet module for managing LUKS encrypted volumes

Code Climate

Setup

Beginning with LUKS

This is a very basic module for configuring encrypted volumes using LUKS on Linux.

Usage

The following creates a LUKS device at /dev/mapper/secretdata, backed by the partition at /dev/sdb1, encrypted with the value of $secret_key:

  include ::luks

  secret_key = hiera('luks_secret')

  luks::device { 'secretdata':
    device         => '/dev/sdb1',
    key            => $secret_key,
    remove_catalog => true,
  }

The secret key should come from somewhere encrypted such as hiera-eyaml.

Reference

Parameters

device

The hardware device to back LUKS with -- any existing data will be lost when formatted as a LUKS device!

key

The encryption key for the LUKS device.

force_format

Instructs LuksFormat to run in 'batchmode' which esentially forces the block device to be formatted, use with care.

base64

Set to true if the key is base64-encoded (necessary for encryption keys with binary data).

Defaults to false.

mapper

The name to use in /dev/mapper for the device.

Defaults to the name to the name of the resource, i.e. /dev/mapper/secretdata

Limitations

Development/Release Notes/Contributors/Etc.

Please feel free to submit issues, and merge requests or generally contribute to this module.