in a stunning display, stepped away from the computer for a few minutes and thought i should check for the BOOT flag, whether i had somehow missed setting the flag during initialisation... sure enough the BOOT flag was missing (as checked with geli dump vtbd0p4, flags were 0x0). after manually attaching it i ran geli configure -bd vtbd0p4 it now prompts for password on boot as expected sorry for the noise, should have been obvious but this will serve for anyone who searches this same issue, i guess.
------- Original Message ------- On Sunday, November 27th, 2022 at 11:10 PM, jmblqe <jmb...@pm.me> wrote: > loader.conf > > aesni_load="YES" > kern.racct.enable=1 > geom_eli_load="YES" > kern.geom.label.disk_ident.enable="0" > kern.geom.label.gptid.enable="0" > zfs_load="YES" > vfs.zfs.arc_max=128M > > geli_vtbd0p4_keyfile_load="YES" > geli_vtbd0p4_keyfile_type="vtbd0p4:geli_keyfile0" > geli_vtbd0p4_keyfile_name="/boot/zroot.key" > vfs.root.mountfrom="zfs:zroot/ROOT/default" > > GPT partition layout on vtbd0 with 4 partitions > 1 freebsd-boot > 2 freebsd-ufs 1G partition with /boot > 3 freebsd-swap > 4 freebsd-zfs, geli encrypted with 256-bit zroot.key that's on vtbd0p2 > > this same setup works successfully on different machines; the only > differences are the following > > - identifiers- zpool name, filename of key, etc (loader.conf is identical > otherwise, as far as i can tell from visual inspection) > - actual number of partitions (some hosts don't have swap, some hosts have > additional partitions) > - amount of memory, size of disk, etc (this host has only 512MB memory) > - actual hypervisor being provided by my hosting provider (don't see how that > would matter though) > > among the systems, the kernels, /boot/loader binary, /boot/kernel/geom_eli.ko > binary, are all identical as confirmed by md5 > > other notes > > - the problem host in question doesn't display any messages about geli during > boot, other than the loader noting that it has loaded the key and the > specified modules > - it just arrives at mountroot, which fails (since the provider hasn't been > decrypted) > - booting from a CD, i can geli attach without issues, using the key in > vtbd0p2 > - default options on geli except keysize 256 > > wondering what further steps i can take to diagnose this issue > thanks