EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 17·5 min read
Passphrase-less reboots using kexec under NixOS
TL;DR
A new method using kexec in NixOS allows servers to reboot without manual decryption of encrypted hard drives, enhancing security and efficiency. This approach eliminates the need for human intervention during reboots, reducing downtime and error risk.
✦ Why It Matters
Implement kexec in your NixOS servers to streamline reboots and enhance security without manual intervention.
Key Takeaways
- Utilize kexec for faster kernel reboots without hardware shutdown.
- Store temporary LUKS passphrases securely in RAM during reboots.
- Modify systemd services to automate the reboot process.
- Ensure encryption remains intact by deleting temporary keys post-reboot.
How It Works
The kexec mechanism allows the current Linux kernel to load a new kernel without a full reboot, enabling the transfer of a temporary LUKS passphrase stored in RAM. This passphrase is created and used during the reboot process, ensuring that the encrypted hard drive can be accessed without manual input.