On 6/23/26 01:22, [email protected] wrote:
On Tue, Jun 23, 2026 at 08:00:11AM +0200, Michel Verdier wrote:
On 2026-06-22, [email protected] wrote:
On 6/21/26 23:18, Michel Verdier wrote:
RAID is always before LUKS : partition > RAID array > LUKS > filesystem
"Is always" means for you "should always be" or "has to be"?
"has to be". LUKS encrypt a partition in a unique way. So 2 encrypted
partitions are always different and cannot be synced.
I think that is wrong.
+1
Both configurations work, but have different performance and security
considerations:
* partitions > RAID > encryption > filesystem
Will encrypt the RAID virtual block device, saving CPU cycles and
requiring one passphrase and/or key.
* partitions > encryption > RAID > filesystem
Will encrypt each partition, arguably improving security but
requiring more CPU cycles and passphrases/ keys.
My SOHO file server uses ZFS, which combines RAID > filesystem. (ZFS
native encryption has issues, so I avoid it.) So, the file server must
use a variation of the above latter I/O layering configuration:
partitions > encryption > ZFS
David
