# truenas-kmip-unlocker
Encrytped secrets are stored within the [secrets.ini](secrets.ini.sample) file.

**This will work with native zfs encryption but it will only unlock the top encrypted dataset and the children must be encrypted with the same passphrase. This continues to support GELI encrpyted pools.**

#### Install pyKMIP on the computer
```shell
pip install pykmip
```

#### Setup the PyKMIP.conf file
A sample file is inlcuded [here](pykmip/client.conf.sample) and sould be used a base.  Please copy the file (removing the .sample) and change the variables, the cert paths will need to absolute.
```ini
[client]
host=127.0.0.1
port=5696
certfile=/root/kmip.crt
keyfile=/root/kmip.key
ca_certs=/root/kmip.crt
cert_reqs=CERT_REQUIRED
ssl_version=PROTOCOL_TLS
do_handshake_on_connect=True
suppress_ragged_eofs=True
```

#### Encrypt your secrets
* Encrypt your api key for truenas
* Encrypt the passphrase for your pool/dataset
* Encrypt your remaining pool/dataset passphrases as needed

Run the following command to encrypt your secrets, it will ask for your pool/dataset passphrase that you want to encrypt and to confirm it before outputting the encrypted passphrase.  Take the encrypted secret and create a new section in the config ini file for the pool/dataset; your encrypted api key goes into the DEFAULT section.  The section name will be the pool/dataset name and the only key in that section is the encrypted_key which will be this value.
```shell
python truenas-kmip-unlock.py --encrypt
```

#### Create Task   
Create a PostInt task that will call this script to unlock the drives
```shell
python /root/truenas-kmip-unlocker/truenas-kmip-unlock.py
```

#### Debugging
Nothing is logged to a file for this. Everything is output to the console. To enabled debug mode, pass the **[-v|--verbose]** argument when running the command. If the verbose argument is passed in, all passphrases will be outputted in plain text to the console.  This is to ensure the decryption is working correctly.
```python
python /root/truenas-kmip-unlocker/truenas-kmip-unlock.py --verbose
```