[** VIDEO GUIDE ** How to securely autostart an encrypted unRAID array]

35 minutes ago, Lynxphp said:

Works like a charm! Thanks.

 

 

 

I don't use my main nextcloud instance (which is hosted on unraid) to store the key, but rather a free provider https://woelkli.com/en where i only keep a duplicati encrypted backup of some stuff. I'm aware it's not an ideal solution, but it will do for my needs.

  

 

 

I think i understood what you were doing ... but instead of storing the secret Keyfile on the unraid Server, now you have your credentials to access your free Provider nextcloud storage written in plain text in the "curl -u ..." Statement (within the fetch_key script). Thats what i meant with "replacing one secret with another".

 

But if thats fine for your needs, im the last one to complain

 

Greetings, Dirk

[** VIDEO GUIDE ** How to securely autostart an encrypted unRAID array]

Thats exacly what i did ... i followed bonienl's directions and just modified the fetch_key script with the appropriate command to fetch the key from my source. That works flawlessly.

 

The reason i didnt go for a nextcould solution is, that i had a bad Feeling replacing one secret stored on the unraid Server with another (your nextcloud username/password).

[** VIDEO GUIDE ** How to securely autostart an encrypted unRAID array]

I took the following approach to implement this using a free cloud solution:

 

1) signed up for a free account on https://sandstorm.io/ 

2) installed the "FileDrop"-App out of their "app market" (project itself is hosted here: https://github.com/zombiezen/filedrop/)

3) Uploaded the keyfile there

4) Generated a read-only Web-Key (Role "viewer") to access this from my Unraid box this returns you an access URL:  https://api-<someApiKey>.oasis.sandstorm.io#<someAuthToken> 

5) modified bonienl's fetch_key script to fetch the keyfile via 'curl -H 'Authorization: Bearer <someAuthToken>' -s https://api-<someApiKey>.oasis.sandstorm.io/file/keyfile > keyfile'

 

The <someApiKey> and <someAuthToken> are to be replaced with the aktual values seen in your access URL 

 

Works like a charm for me ... thanks for all the great ideas here