{"title":"the website of jyn","subtitle":"i write about code, and things that bring me joy, and sometimes other things too","link":[{"@attributes":{"rel":"self","type":"application\/atom+xml","href":"https:\/\/jyn.dev\/atom.xml"}},{"@attributes":{"rel":"alternate","type":"text\/html","href":"https:\/\/jyn.dev"}}],"generator":"Zola","updated":"2026-01-22T00:00:00+00:00","id":"https:\/\/jyn.dev\/atom.xml","entry":[{"title":"remotely unlocking an encrypted hard disk","published":"2026-01-22T00:00:00+00:00","updated":"2026-01-22T00:00:00+00:00","author":{"name":"\n \n jyn\n \n "},"link":{"@attributes":{"rel":"alternate","type":"text\/html","href":"https:\/\/jyn.dev\/remotely-unlocking-an-encrypted-hard-disk\/"}},"id":"https:\/\/jyn.dev\/remotely-unlocking-an-encrypted-hard-disk\/","summary":"what's a few systemd services in initramfs between friends?","content":"

Your mission, should you choose to accept it, is to sneak into the earliest parts of the boot process, swap the startup config without breaking anything, and leave without a trace.<\/p>\n

Are you ready? Let's begin.<\/p>\n

the setup<\/a>\n<\/h2>\n

In which our heroes are introduced, and the scene is set.<\/em><\/p>\n

For a very long time I had a beat-up old ThinkPad that couldn\u2019t hold a charge for the life of it, especially when running Windows. It tended to die a lot when I was traveling, and I travel a lot. To save battery when I\u2019m away from home, I often ssh back into my home desktop, both so I have persistent state even if my laptop battery dies, and so I get much faster builds that don\u2019t kill the battery.<\/p>\n

This has two small problems:<\/p>\n

    \n
  1. Sometimes my home loses power and the desktop shuts off.<\/li>\n
  2. Sometimes when the power comes back on it has a new public IP.<\/li>\n<\/ol>\n

    For a long time I solved 1. by enabling \u201cPower On\" after \"Restore AC Power Loss\u201d in the BIOS and 2. with tailscale<\/a>. However, I recently installed Arch with an encrypted boot partition, which means that boot doesn\u2019t finish until I type in the encryption password.<\/p>\n

    Well. Well. What if I Simply put tailscale in initramfs?<\/p>\n

    the plan<\/a>\n<\/h2>\n

    In which our intrepid heroes chart the challenges to come.<\/em><\/p>\n

    initramfs<\/a>\n<\/h3>\n

    Oh, right. If you weren\u2019t aware, early boot in a Linux operating system1<\/a><\/sup> is just running a full second operating system that happens to be very small, lol. That\u2019s loaded from a compressed archive file in \/boot2<\/a><\/sup> and run from memory, with no access to persistent storage. This OS running from memory is called initramfs<\/strong> (initial RAM filesystem).<\/p>\n

    So when you see a screen like this:\n\"\"\nThat\u2019s actually a whole-ass OS, with an init<\/code> PID and service management and everything. This is how, for example, systemd-analyze<\/code> can show you stats about early boot \u2014 there\u2019s another copy of systemd running in initramfs, and it passes its state off to the one in the main OS.<\/p>\n

    Well. That implies we can install things on it ^^.<\/p>\n

    constraints<\/a>\n<\/h3>\n

    There\u2019s three parts to this:<\/p>\n

      \n
    1. Networking in initramfs<\/li>\n
    2. Tailscale in initramfs<\/li>\n
    3. SSH in initramfs<\/li>\n<\/ol>\n

      We also want to make this as secure as possible, so there\u2019s some more things to consider:<\/p>\n