Hello,

 

I recently moved from unRAID on bare metal to using Proxmox on bare metal, with unRAID virtualized.  I had a specific need to use Proxmox, and this setup is hopefully transitional (weeks or months). Below is my setup: 

• Proxmox VM - 6 CPUs (host-passthrough), 16GB RAM, q35 chipset, OVMF BIOS
• Instead of passing through the entire HBA, I passed through each individual HDD (Disk cfg: Cache=Default, AsyncIO=thread, IO Thread=enabled. VM cfg: Controller=VirtIO SCSI Single)
• For cache, I just created a 256GB virtual disk inside an encrypted ZFS dataset on an NVMe-backed pool. 
• Passed through the unRAID USB stick.
• I moved all VMs out of unRAID and disabled the VM system (I also disabled IOMMU to the unRAID VM)
• I moved all dockers out of unRAID except plex and filebot. 

 

My array is XFS + LUKS encrypted. Previously I would just login to the Web UI, enter the password and start the Array manually.  This was getting annoying, so I did the below to safely(?) use a keyfile.

1. Created a tiny 128MB disk on an encrypted ZFS dataset in proxmox, formatted it in unRAID but did not add to pool or cache. Manually mounted with the mount command as /key/
2. Started array, followed these instructions to create a keyfile /key/array, and uses the mentioned commands to add it to every /dev/mdXp1 in my array.
3. Added this as the first command in /boot/config/go, since UD will not mount a disk until the array is started.

   mkdir /key && chown root:root /key && chmod 700 /key && mount /dev/XXXXX /key 

    

4. Ensured these lines were in /boot/config/disk.cfg: 

   startArray="yes"
   luksKeyfile="/key/array"

    

 

Not sure if this is overkill or not?? I could not figure out how to get the disk to auto-mount with UD, hence my addition to /boot/config/go.  I also could not figure out how to add the keyfile entry to disk.cfg, so I added it myself.

 

Since the array is encrypted, I wanted to ensure the passphrase and/or keyfile were secured.  Since I have encrypted datasets on Proxmox, which require a passphrase on boot, I figured this is secure.  The keyfile will only be accessible if the proxmox zfs passphrase is entered. 

 

Please let me know if I am crazy   This is just transitional until I either get more hardware and/or decide what to do with my storage.

Edited July 8, 20242 yr by coffee1978
clarify

Little late to the party…

Im doing something similar.

In my /boot/config/go:

scp <proxmox-host>:/<path-to-enc-key-on-zfs-encrypted-fileset>/keyfile /root/keyfile