Re: The official disk encryption guide seems a bit lacking (detailed list of concrete improvement suggestions!)

[Ellie <el%horse64.org@localhost>]

On 10/28/26 12:01 AM, Ellie wrote:
> I just thought I'd document the sort of things here I would have 
> expected to find in the official NetBSD disk encryption guide:
>
>   https://www.netbsd.org/docs/guide/en/chap-cgd.html
>
> [...]
>
> Perhaps this will inspire somebody who knows how to fill in the gaps:

It was brought to my attention NetBSD 11 likely doesn't support the 
system partition / being encrypted and using ZFS, at all.

Then I think the logical next best setup is, for both the guide and 
perhaps a hypothetical future "install it for me please" option:

1. A GPT partition layout, and

2. /etc/cgd boot partition unencrypted, and

3. optionally an EFI partition for modern GPT UEFI boot setup, and

4. / system disk encrypted using UFS2, and

5. /home encrypted using ZFS (or in the future perhaps GeFS), and

6. some optional X megabytes of free disk space at the end, both to be 
able to be nicer to SSDs and to leave room for custom expansion later.

If this sort of setup were to be more readily available to a beginner, 
either as a full guide or as a script, I think it would greatly improve 
NetBSD's suitability for a standard modern workstation setup!

I hope somebody finds this useful. Also, happy for pointers regarding 
how to install it that way...

Regards,

Ellie