4 ms·
I use NBD for my single-user NAS. You can use FDE (full disk encryption, luks) client-side. The system managing the physical block devices never sees unencrypt
by coppsilgold 4y ago
I use NBD for my single-user NAS. You can use FDE (full disk encryption, luks) client-side.
The system managing the physical block devices never sees unencrypted data.
Such a setup shines when you use a laptop as your main machine and wish to have a lot of secure storage. The approach I chose was to bond ethernet & wifi6e, use wireguard (w/ PSK). And wonder the house with uninterrupted access.
- codethief 4y agoThis sounds really interesting, as in: It's the thing I didn't know I've been looking for because I didn't know it existed. Could you elaborate on your NBD setup? (What do you use for the server?) And what kind of latencies do you see when you're at home / not at home? How do you handle backups? (Do you back up the encrypted blob server-side or do you back up the unencrypted data client-side, at the cost of having to deal with (probably) limited bandwidth & latencies.)
- coppsilgold 4y agoI just use nbd-server, nbd-client (kernel module nbd). While at home things are fine, when not at home things can get bad unless you use something like UDPspeeder <https://github.com/wangyu-/UDPspeeder https://github.com/wangyu-/UDPspeeder> then you just need to deal with slower speeds. I do backups with borg while connected to the NAS with ethernet.
- codethief 4y agoThanks so much for the insights! > While at home things are fine, when not at home things can get bad What does "bad" mean exactly? Unrecoverable errors / faulty writes? It might be an irrational gut feeling on my part but for some reason operating a block device over a network makes me feel uneasy. How easy is it to mess up one's data?
- coppsilgold 4y agoNBD uses TCP. And I had no unrecoverable (journal) corruption happen. Imagine you had a physical drive which had unreliable reads and writes but that would always go through eventually. In that scenario I believe you would just have abysmal latency as the OS keeps retrying - and if the latency between retries was in milliseconds the actual speed would drop next to 0. That said, sudden unrecoverable loss of connectivity would be equivalent of yanking out a physical drive. You would want to use a journaling filesystem.
- codethief 4y agoThanks for elaborating!