SYSTEMD-C...GENERATOR(8)

🎀 NAME 🎀

systemd-cryptsetup-generator — bestie, it's the unit generator for /etc/crypttab 💖 (yes that's systemd-cryptsetup-generator(8) in full, say it with your chest)

---

✨ SYNOPSIS ✨

/usr/lib/systemd/system-generators/systemd-cryptsetup-generator

---

🦋 DESCRIPTION 🦋

okay so listen. systemd-cryptsetup-generator is a generator — and what it does is it takes your /etc/crypttab and translates it into native systemd units. Early. At boot. And also whenever the system manager's config gets reloaded. ✨

It'll create systemd-cryptsetup@.service(8) units as necessary — as many as it needs, whenever it needs them. no cap.

And for the record: systemd-cryptsetup-generator implements systemd.generator(7). 📜

---

👑 KERNEL COMMAND LINE 👑

She understands the following kernel command line parameters, bestie. Every single one. Let's go:

• luks=, rd.luks= — takes a boolean argument. Defaults to "yes". If "no", it disables the generator entirely — like, whole thing, gone. rd.luks= is honored only in the initrd, while luks= is honored by both the main system and in the initrd.

Added in version 186. 🌸

• luks.crypttab=, rd.luks.crypttab= — takes a boolean argument. Defaults to "yes". If "no", the generator just ignores any devices configured in /etc/crypttab (luks.uuid= will still work however, so don't panic). rd.luks.crypttab= is honored only in initrd while luks.crypttab= is honored by both the main system and in the initrd.

Added in version 186. 🌸

• luks.uuid=, rd.luks.uuid= — takes a LUKS superblock UUID as argument. This will activate the specified device as part of the boot process, as if it was listed in /etc/crypttab. You can specify this option more than once to set up multiple devices — she's flexible like that 💅. rd.luks.uuid= is honored only in the initrd, while luks.uuid= is honored by both the main system and in the initrd.

If /etc/crypttab contains entries with the same UUID, then the name, keyfile and options specified there will be used. Otherwise, the device will have the name "luks-UUID".

If /etc/crypttab exists, only those UUIDs specified on the kernel command line will be activated in the initrd or the real root. 🫶

Added in version 186. 🌸

• luks.name=, rd.luks.name= — takes a LUKS super block UUID followed by an "=" and a name. This implies rd.luks.uuid= or luks.uuid= and will additionally make the LUKS device given by the UUID appear under the provided name. iconic behavior honestly.

This parameter is the analogue of the first crypttab(5) field volume-name.

rd.luks.name= is honored only in the initrd, while luks.name= is honored by both the main system and in the initrd.

Added in version 218. 🌸

• luks.data=, rd.luks.data= — takes a LUKS super block UUID followed by a "=" and a block device specification for the device hosting encrypted data.

For those entries specified with rd.luks.uuid= or luks.uuid=, the data device will be set to the one specified by rd.luks.data= or luks.data= of the corresponding UUID.

LUKS data device parameter is useful for specifying encrypted data devices with detached headers specified in luks.options entry containing "header=" argument. For example:

rd.luks.uuid=b40f1abf-2a53-400a-889a-2eccc27eaa40
rd.luks.options=b40f1abf-2a53-400a-889a-2eccc27eaa40=header=/path/to/luks.hdr
rd.luks.data=b40f1abf-2a53-400a-889a-2eccc27eaa40=/dev/sdx

Hence, in this case, we will attempt to unlock LUKS device assembled from data device "/dev/sdx" and LUKS header (metadata) put in "/path/to/luks.hdr" file. This syntax is for now only supported on a per-device basis, i.e. you have to specify LUKS device UUID. 🧚

This parameter is the analogue of the second crypttab(5) field encrypted-device.

rd.luks.data= is honored only in the initrd, while luks.data= is honored by both the main system and in the initrd.

Added in version 247. 🌸

• luks.key=, rd.luks.key= — takes a password file name as argument, or a LUKS super block UUID followed by a "=" and a password file name.

For those entries specified with rd.luks.uuid= or luks.uuid=, the password file will be set to the one specified by rd.luks.key= or luks.key= of the corresponding UUID, or the password file that was specified without a UUID.

It is also possible to specify an external device which should be mounted before we attempt to unlock the LUKS device. systemd-cryptsetup will use password file stored on that device. Device containing password file is specified by appending colon and a device identifier to the password file path. For example:

rd.luks.uuid=b40f1abf-2a53-400a-889a-2eccc27eaa40
rd.luks.key=b40f1abf-2a53-400a-889a-2eccc27eaa40=/keyfile:LABEL=keydev

Hence, in this case, we will attempt to mount file system residing on the block device with label "keydev". This syntax is for now only supported on a per-device basis, i.e. you have to specify LUKS device UUID. 🧚

This parameter is the analogue of the third crypttab(5) field key-file.

rd.luks.key= is honored only in the initrd, while luks.key= is honored by both the main system and in the initrd.

Added in version 202. 🌸

• luks.options=, rd.luks.options= — takes a LUKS super block UUID followed by an "=" and a string of options separated by commas as argument. This will override the options for the given UUID. override, periodt.

If only a list of options, without a UUID, is specified, they apply to any UUIDs not specified elsewhere, and without an entry in /etc/crypttab.

This parameter is the analogue of the fourth crypttab(5) field options.

It is possible to specify an external device which should be mounted before we attempt to unlock the LUKS device. systemd-cryptsetup will assemble LUKS device by combining data device specified in luks.data with detached LUKS header found in "header=" argument. For example:

rd.luks.uuid=b40f1abf-2a53-400a-889a-2eccc27eaa40
rd.luks.options=b40f1abf-2a53-400a-889a-2eccc27eaa40=header=/luks.hdr:LABEL=hdrdev
rd.luks.data=b40f1abf-2a53-400a-889a-2eccc27eaa40=/dev/sdx

Hence, in this case, we will attempt to mount file system residing on the block device with label "hdrdev", and look for "luks.hdr" on that file system. Said header will be used to unlock (decrypt) encrypted data stored on /dev/sdx. This syntax is for now only supported on a per-device basis, i.e. you have to specify LUKS device UUID. 🧚

rd.luks.options= is honored only by initial RAM disk (initrd) while luks.options= is honored by both the main system and in the initrd.

Added in version 208. 🌸

---

🌈 SEE ALSO 🌈

systemd(1), crypttab(5), systemd-cryptsetup@.service(8), systemd-cryptenroll(1), cryptsetup(8), systemd-fstab-generator(8)

---

okay that's the whole page bestie, you ate it 💅✨ this one's from systemd 262.1, mwah, go unlock something 🫶🔐💖