LVM & LUKS Administration

The mental stack

Disk → LUKS container → PV → VG → LVs → filesystems. Each layer adds vocabulary but also flexibility (resize anything, span disks, snapshot).

Daily cryptsetup

sudo cryptsetup luksDump /dev/nvme0n1p2 | head    # slots, cipher
sudo cryptsetup open /dev/nvme0n1p2 cryproot      # manual unlock (rescue)
sudo cryptsetup close cryproot
sudo cryptsetup luksAddKey /dev/nvme0n1p2         # enroll backup passphrase/keyfile
sudo cryptsetup luksRemoveKey /dev/nvme0n1p2      # retire one

Rescue flow integration: unlock-then-mount pattern.

LVM daily

sudo vgdisplay ; sudo lvdisplay            # topology
sudo lvextend -r -l +100%FREE /dev/vg/root # grow LV AND filesystem (-r!)
sudo vgs ; lvs                             # compact views

Shrink (ext4): fsck→resize2fs shrink→lvreduce (order matters); xfs cannot shrink.

Growing into new space (typical VM/disk upgrade)

# after partition grows or new PV added:
sudo pvresize /dev/nvme0n1p2        # or pvcreate+vgextend for new disk
sudo lvextend -r -l +100%FREE /dev/vg/root

Hibernation on encrypted swap

Requirements: LV/zram-configured swap ≥ RAM, resume hook:

  1. /etc/mkinitcpio.conf: add resume after encrypt/lvm2 in HOOKS

  2. Kernel cmdline: resume=/dev/vg/swap

  3. sudo mkinitcpio -P then reboot-test suspend once BEFORE trusting it

Full parameter background: Sysctl & Kernel Parameters covers cmdline editing conventions.

When LUKS prompts twice at boot

GRUB unlocks first stage, initramfs re-prompts second stage — normal with /boot-inside-LUKS layouts. Trim friction via keyfile-in-ESP patterns only if threat model permits (Disk Encryption on AcreetionOS tradeoffs).