Learning Devuan GNU/Linux - Storage: Filesystem & Encryption

#Introduction

Data is the most valuable asset on a server, and how you store and protect it determines the system's resilience. Episode 10 covers storage on Devuan: the filesystem choices ext4, XFS, and Btrfs; logical volume management with LVM; and LUKS/dm-crypt disk encryption with initramfs-tools integration.

This topic also bridges concepts you already know: filesystems are mounted through fstab (episode 7), and initramfs prepares the filesystem at boot (episode 2). In this episode you'll see both working together to unlock an encrypted disk.

#Choosing a Filesystem

#ext4: The Reliable Default

ext4 is Devuan's default filesystem and the safest choice for most cases. It's stable, fast for typical workloads, and supports features like journaling and extended attributes. For most servers and desktops, ext4 is the right answer.

Create and mount an ext4 filesystem:

sudo mkfs.ext4 /dev/sdb1
sudo mkdir -p /mnt/data
sudo mount /dev/sdb1 /mnt/data

mkfs.ext4 /dev/sdb1 formats the sdb1 partition. Make sure you format the correct partition — an error here wipes all data.

#XFS and Btrfs

XFS excels at large files and high throughput, making it suitable for file and media servers. Btrfs offers modern features like snapshots, compression, and subvolumes — useful for backup in episode 16. Compare the two:

sudo mkfs.xfs /dev/sdc1
sudo mkfs.btrfs /dev/sdd1

After formatting, both mount normally and can be listed in /etc/fstab. Btrfs also supports btrfs subvolume snapshot for fast backups.

#LVM: Flexible Logical Volumes

#The PV, VG, and LV Concepts

LVM separates storage management from the physical hardware. You wrap disks into Physical Volumes (PV), combine them into a Volume Group (VG), then split it into Logical Volumes (LV) that can be resized without repartitioning.

Basic LVM setup:

sudo apt install lvm2
sudo pvcreate /dev/sde1
sudo vgcreate vgdata /dev/sde1
sudo lvcreate -L 100G -n lvhome vgdata
sudo mkfs.ext4 /dev/vgdata/lvhome

The command lvcreate -L 100G -n lvhome vgdata creates a 100 GB LV named lvhome. The LV appears as /dev/vgdata/lvhome and can be mounted like a normal partition.

#Adding Capacity on the Fly

LVM's advantage is resizing without downtime:

sudo lvextend -L +20G /dev/vgdata/lvhome
sudo resize2fs /dev/vgdata/lvhome

lvextend -L +20G adds 20 GB to the LV, then resize2fs grows the ext4 filesystem to use the new space. For XFS use xfs_growfs instead.

#Encryption with LUKS/dm-crypt

#Creating an Encrypted Volume

LUKS provides the standard format for dm-crypt-based disk encryption. LUKS setup:

sudo apt install cryptsetup
sudo cryptsetup luksFormat /dev/sdb1
sudo cryptsetup open /dev/sdb1 data
sudo mkfs.ext4 /dev/mapper/data

cryptsetup luksFormat /dev/sdb1 creates an encrypted container and asks for a passphrase. The open command unlocks the container and maps it as /dev/mapper/data — that device is what you format and mount.

#Mount and fstab

The decrypted device can be mounted like a normal partition:

sudo mkdir -p /mnt/secret
sudo mount /dev/mapper/data /mnt/secret

For automatic mounting at boot, you need to register the mapping in /etc/crypttab and a mount line in /etc/fstab — both are read by initramfs.

#Integration with initramfs-tools

#Enabling LUKS Unlock at Boot

initramfs-tools is Devuan's tool for building initramfs. For an encrypted root partition, the initramfs must include cryptsetup and the right hooks:

echo "CRYPTSETUP=y" | sudo tee -a /etc/cryptsetup-initramfs/conf-hook
sudo update-initramfs -u

update-initramfs -u rebuilds the initramfs with the latest configuration. At boot, the initramfs will ask for the passphrase before the root is mounted. Also add rd.luks.crypttab or the appropriate kernel parameter to GRUB as needed.

#Closing a Volume Safely

To release an encrypted volume properly:

sudo umount /mnt/secret
sudo cryptsetup close data

cryptsetup close data closes the mapping and re-locks the data. Always umount before close so no process is still writing.

#Conclusion

Episode 10 covered storage on Devuan: ext4 as the reliable default, XFS for large files, Btrfs for snapshots, LVM for flexible logical volumes, and LUKS/dm-crypt encryption with initramfs-tools integration so root partitions can be unlocked at boot.

Key takeaways:

• ext4 is the default filesystem; XFS and Btrfs serve specific needs.
• LVM separates volume management from physical hardware.
• lvextend and resize2fs grow an LV without downtime.
• LUKS provides the standard dm-crypt-based encryption format.
• initramfs-tools must be updated after changing LUKS configuration.
• Always umount before cryptsetup close.

In the next episode, episode 11, we'll cover kernel and firmware — choosing and installing linux-image, understanding Devuan's linux-lts, building initramfs, and installing firmware-linux and microcode for your hardware.