<div align="center">
  <img src='./icon.svg' width="150px">
  <h2>nullpoint</h2>
  <br>
</div>

Secure Fedora Server setup with LUKS encryption, TPM, and BTRFS RAID1 with focus on Hetzner Infra.

## Features

- Fedora Server base
- Full disk encryption with LUKS
- Remote unlock via Tang server
- TPM-based boot verification
- BTRFS RAID1 storage with optimized subvolumes
- Automated deployment to Hetzner
- Cloud-init based configuration

## Security Model

### Unlock Methods
The system uses multiple methods to unlock the LUKS volumes:
1. **Primary Method**: TPM2 + Tang server
   - TPM2 verifies boot integrity
   - Tang server provides remote unlock capability
   - Both must succeed for automatic unlock
2. **Fallback Method**: Manual passphrase
   - Available via SSH if primary method fails
   - Can be used for recovery or maintenance

### TPM Integration
- TPM2 chip verifies boot integrity
- PCR measurements ensure system hasn't been tampered with
- Combined with Tang for defense in depth
- Monitors all critical boot components

### Storage Security
- BTRFS RAID1 for data redundancy
- Dedicated database subvolume with `nodatacow` and `noatime`
- LUKS2 encryption with multiple unlock methods
- Secure boot enabled by default
- Redundant boot partition using BTRFS RAID1

### TPM Updates
After firmware updates (UEFI/BIOS), the TPM bindings need to be updated:
(otherwise the system will not be able to boot without recovery phrase)
1. Use the provided script: `sudo /root/update-tpm-bindings.sh`
2. The script will:
   - Show current PCR values
   - Update TPM bindings to match new measurements
   - Verify all bindings are correct
3. Manual passphrase is available in `/root/luks-passphrase.txt` if needed

## Repository Structure
```
.
├── build.py             # Build and upload image from build-config
├── deploy.py            # Deployment script for Hetzner from deploy-config
├── MASTER_README.md     # Tang server setup documentation
├── README.md            # Main project documentation
└── requirements.txt     # Python dependencies
```

## Prerequisites

```bash
# Install tools
curl -fsSL https://raw.githubusercontent.com/hetznercloud/cli/master/install.sh | bash
go install github.com/hetznercloud/hcloud-upload-image@latest
sudo dnf install -y jq python3-pyyaml libguestfs-tools cloud-image-utils curl

# Configure Hetzner
export HCLOUD_TOKEN="your-token-here"
hcloud ssh-key create --name "fedora-server-hetzner" --public-key "$(cat ~/.ssh/id_ed25519.pub)"
```

## Setup

1. **Configure Build Settings**
   ```bash
   cp build-config.yaml.example build-config.yaml
   vim build-config.yaml  # Edit LUKS, storage, and image settings
   ```

2. **Build Base Image** (one-time setup)
   ```bash
   python3 build.py  # Creates and uploads Fedora Server image to Hetzner
   ```

3. **Configure Deployment Settings**
   ```bash
   cp deploy-config.yaml.example deploy-config.yaml
   vim deploy-config.yaml  # Edit server type, location, and hostname settings
   ```

4. **Deploy Server**
   ```bash
   python3 deploy.py  # Creates new server from base image
   ```

5. **Verify**
   ```bash
   ssh admin@your-server
   systemctl status clevis-luks-askpass
   lsblk
   clevis-luks-list -d /dev/sda2
   ```