nullpoint

Secure Fedora Server setup with LUKS encryption, TPM, and BTRFS RAID1 for (Hetzner) Dedicated Servers.

Note

This project is still WIP, having some issues with networking of the installeer / installed instance.

Features

• Fedora Server base
• Full disk encryption with LUKS
• Remote unlock via Tang server
• TPM-based boot verification
• BTRFS RAID1 for data redundancy
• Dedicated database subvolume with nodatacow and noatime
• SSH key-only access with early boot SSH via dropbear

If you need a dead man's switch to go along with it check out raven.

Security Model

Unlock Methods

The system uses multiple methods to unlock the LUKS volumes:

1. Primary Method: TPM2 + Tang server
   • TPM2 verifies boot integrity
   • Tang server provides remote unlock capability
   • Both must succeed for automatic unlock
2. Fallback Method: Manual passphrase
   • Available via SSH before LUKS unlock
   • Uses dropbear for early SSH access
   • Can be used for recovery or maintenance

TPM Updates

After firmware updates (UEFI/BIOS), the TPM bindings need to be updated: (otherwise the system will not be able to boot without recovery phrase)

1. Use the provided script: sudo /root/update-tpm-bindings.py
2. The script will:
   • Show current PCR values
   • Update TPM bindings to match new measurements
   • Verify all bindings are correct
3. Manual passphrase is available in /root/luks-passphrase.txt if needed

Setup

1. Configure Installer

   # Edit the variables at the top of install.sh:
   vim install.sh
   

   Set your:

   • Tang server URLs and thumbprints
   • TPM PCR settings
   • Fedora version
   • SSH public key for the default user

2. Install on Hetzner Server

• Log into Hetzner Robot
• Select your server
• Go to "Rescue" tab
• Choose "Linux" and "64 bit"
• Activate Rescue System
• Upload the installer:

  scp install.sh root@your-server:/root/
  

• SSH into Rescue System:

  ssh root@your-server
  

• Make it executable and run:

  chmod +x install.sh
  ./install.sh
  

• If the script tells you that no TPM is available, you'll need to make a support ticket to get KVM access and enable TPM in the BIOS.
• The script will:
  • Generate and display a LUKS passphrase (save this!)
  • Download and prepare the Fedora installer
  • Configure networking for Hetzner's unusual setup
  • Start the Fedora installer
• You can monitor the installation via SSH on port 2222:

  ssh -p 2222 root@your-server
  

• During the Fedora installation:
  • Disk encryption and RAID will be configured
  • TPM and Tang bindings will be set up
  • Network configuration will be applied

3. Verify Installation

   ssh null@your-server
   systemctl status clevis-luks-askpass
   lsblk
   btrfs filesystem show  # Check RAID1 status
   clevis-luks-list -d /dev/sda3  # Note: sda3 is the LUKS partition