dracut VS wireguard-initramfs

Upstream has been telling people not to use a central configuration file for 8 years so nobody should really be putting anything in there to begin with. One can make a reasonable argument that ZFSBootMenu ought to override the configuration file just like it overrides the configuration drop-in directory, but another can make a reasonable argument that people who really know what they want may wish to load common configuration options for both their system and ZBM images in /etc/dracut.conf.

I absolutely have no idea... Seems like somehow something is not supported. You should create an issue in the dracut repo: https://github.com/dracutdevs/dracut/issues. That's something you should probably everywhere like I did in my issue: https://www.reddit.com/r/voidlinux/comments/11ofqt2/booting_with_dinit. The void community can sometimes be really unhelpful so I hope you will get help there.

bug 1529311 is closed as duplicate of bug 1476039 which was fixed by https://access.redhat.com/errata/RHBA-2018:0964 included in dracut-033-535.el7. These patches were mentioned in 1476039: https://github.com/dracutdevs/dracut/commit/19453dc8744e6a59725c43b61b2e3db01cb4c57c and https://github.com/dracutdevs/dracut/pull/261. Also it was mentioned that it was fixed in

It's a shell script that sets up some basics and runs an event loop to run hooks that eventually lead to the availability of your root device.

dracut can build initrd with bluetooth support

The documentation is super minimal, but the livenet module supports torrent files using the live:torrent: URL syntax.

Nope, all these environments are missing initial device configuration required for keyboard to be able to connect. (There was an attempt to add bluetooth support into dracut, that didn't go well)

I get exactly this error. So it turns out, the decryption depends on a systemd unitsystemd-cryptsetup-generator, which will not read any embedded cmdline parameters, only ones passed in the commandline so when the commandline parameter is asking to decrypt things, it is not generated.

Some other interesting things are providing keys over the network, or leveraging Wireguard and SSH to remotely unlock.

For vulnerabilities: even if dropbear was vulnerable in some way, it’s running in a pre-boot initramfs with a restricted shell which can be locked down even further to prevent escalation. To add another layer of security, you can run Wireguard in initramfs and have dropbear configured to be accessible from only the vpn network: https://github.com/r-pufky/wireguard-initramfs

Once you manage to reset the system, wireguard-initramfs should work if you need to SSH into it from outside the LAN, though the project is only currently supported on Debian. Within the LAN, dropbear in your initramfs should be enough.

There are other initramfs packages available that expand features such as wireguard capability: https://github.com/r-pufky/wireguard-initramfs

FYI, this is now the case. 2021-07-04

Just posted the first rev of wireguard-initramfs for debian bullseye.