Will we be able to encrypt the Internal boot device in future or can we do it now considering tpm 2.0 licensing instead. I want this really to be a feature cause it's a big problem config is unencrypted

I'm migrating to an internal boot and was actually surprised I couldn't do an encrypted boot drive. This is the perfect opportunity to convert to encrypted as I hadn't already since I have to reformat the drive anyways. What gives here?

1 hour ago, whisp said:

I'm migrating to an internal boot and was actually surprised I couldn't do an encrypted boot drive

The boot drive is handled by the BIOS before Unraid is loaded so you could only encrypt the boot drive if the BIOS understood the encryption.

14 minutes ago, whisp said:

I'm migrating to an internal boot and was actually surprised I couldn't do an encrypted boot drive. This is the perfect opportunity to convert to encrypted as I hadn't already since I have to reformat the drive anyways. What gives here?

As mentioned above - this is a chicken and egg problem. There is no universally established encryption standard for boot device encryption. The bootloader must be unencrypted out of necessity, not out of lack of security. There has to be machine code that can be executed. If we encrypted the bootloader, we would need a shim bootloader to decrypt the actual bootloader and/or boot partition(s). At some point the key(s) would need to be presented in order to facilitate boot. Somewhat of a solution is possible now with TPM2.0 and Secure Boot - but no off-the-shelf solution for integration is available presently. Suffice it to say though: If an attack has physical access to your device - you have already lost.

Hmm, how does Bitlocker do it?

On 5/28/2026 at 2:32 PM, whisp said:

Hmm, how does Bitlocker do it?

The "SYSTEM" partition is unencrypted, which containers the bootloader pieces needed to do the initial handshake with either TPM or a user to manually type in the encryption key. Once the key for decryption is obtained, the volume is decrypted in-flight on read operations and encrypted in-flight on write operations. It is possible for Linux to be configured in a similar manner - but "something" has to hold the key. BitLocker suffers from the same physical security limitation as whatever Linux implementation you would use in this scenario. If an attacker has physical access to the machine, they have access to the TPM and the Boot Media. The volume is already able to be decrypted with these two pieces so it may as well be unencrypted.

Edited June 5Jun 5 by Xaero

On 6/5/2026 at 9:16 PM, Xaero said:

The "SYSTEM" partition is unencrypted, which containers the bootloader pieces needed to do the initial handshake with either TPM or a user to manually type in the encryption key. Once the key for decryption is obtained, the volume is decrypted in-flight on read operations and encrypted in-flight on write operations. It is possible for Linux to be configured in a similar manner - but "something" has to hold the key. BitLocker suffers from the same physical security limitation as whatever Linux implementation you would use in this scenario. If an attacker has physical access to the machine, they have access to the TPM and the Boot Media. The volume is already able to be decrypted with these two pieces so it may as well be unencrypted.

But /config folder could be encrypted and other parts right? I don't think plugin and those configuration needs to be available at that time