systemd-creds allow per-service custom decryption keys

[dinetxum]

Component

other

Is your feature request related to a problem? Please describe

Most of dedicated servers are delivered with unencrypted system.

Describe the solution you'd like

Allow per-service custom credentials decryption key configuration option

UseHostPrivatetKey
UseTpmPublicKey

Usage example

Generate per-service custom host decryption key

systemd-creds setup
Credential secret file '/var/lib/systemd/credential.secret' is not located on encrypted media, using anyway.

Save to encrypted volume

cp /var/lib/systemd/credential.secret /encrypted/volume/private/key/here/credential.secret

Delete key

rm -f /var/lib/systemd/credential.secret

Generate default host decryption key

systemd-creds setup
Credential secret file '/var/lib/systemd/credential.secret' is not located on encrypted media, using anyway.

Print service systemd configuration file

cat '/etc/systemd/system/[email protected]/credentials.conf'

[Service]
SetCredentialEncrypted=public_key_name: \...CREDENTIAL_HERE_PART_1...==
SetCredentialEncrypted=private_key_name: \...CREDENTIAL_HERE_PART_2...==

UseHostPrivatetKey=/encrypted/volume/private/key/here/credential.secret
#UseTpmPublicKey=/encrypted/volume/public.pem

Reload daemon

systemctl daemon-reload

Start service

systemctl start 'dinetxum-stage@testnet1'

Use of decrypted service credentials

Read it from related service

Describe alternatives you've considered

• Bind mount, difficult to manage.
• Symbolic link, does not work.
• Full encryption, not available at all.
• Copy & delete host key (/var/lib/systemd/credential.secret) each time, does not work with system hard reset or reboot.
• Use tmpfs with /var/lib/systemd/ and copy from encrypted volume, difficult to manage.
• ...

The systemd version you checked that didn't have the feature you are asking for

255