truenas-kmip-unlocker

Encrytped secrets are stored within the secrets.config file.

Install pyKMIP on the computer

pip install pykmip

Setup the PyKMIP.conf file

A sample file is inlcuded here and sould be used a base. Please copy the file (removing the .sample) and change the variables, the cert paths will need to absolute.

[client]
host=127.0.0.1
port=5696
certfile=/root/kmip.crt
keyfile=/root/kmip.key
ca_certs=/root/kmip.crt
cert_reqs=CERT_REQUIRED
ssl_version=PROTOCOL_TLS
do_handshake_on_connect=True
suppress_ragged_eofs=True

Encrypt your secrets

Follow the prompts to enter your information. All information entered is encrypted

Run the following command to configure everything

python truenas-kmip-unlock.py --config

Create Task

Create a PostInt task that will call this script to unlock the drives

python <SCRIPT PATH>/truenas-kmip-unlock.py

Containers, Apps, and Virtual Machines

This script used to loop through jails to start them but it seems TrueNAS auto starts VMS, apps, and containers that are located on locked datasets after they are unlocked. the Virtual Machines need to have the start at boot option turned on for this to work.

Debugging

Nothing is logged to a file for this. Everything is output to the console. To enabled debug mode, pass the [-v|--verbose] argument when running the command.

python truenas-kmip-unlock.py --verbose