Feat: docs: TPC and backups

3 files changed, 541 insertions, 2 deletions

diff --git a/docs/backups.md b/docs/backups.md
new file mode 100644
index 0000000..f6faf8a
--- /dev/null
+++ b/docs/backups.md
@@ -0,0 +1,146 @@
+# Backups and syncs
+
+This mostly has to do with `hydractl` commands such as
+`sync-{backups,media,tpc}`.
+
+## Servers
+
+* Backups can be automatically generated and sent to other servers, including
+  NAS instances.
+* Automated backup checking can be done.
+* But all this does not exempt a team from manually testing backups and to make
+  their own offline copies in external drives.
+
+## New external drive
+
+Proceed as follows
+
+    disk=new-disk-name
+    device=/dev/sdc
+    hydractl usb-enable   # run this for USB drives, then connect the disk
+    sudo cfdisk ${device} # layout with single ${device}1 partition
+    sudo cryptsetup luksFormat ${device}1
+    sudo cryptsetup luksOpen ${device}1 $disk
+    sudo mkfs.ext4 /dev/mapper/$disk
+    sudo mkdir /media/$disk
+    sudo mount /dev/mapper/$disk /media/$disk
+    sudo mkdir /media/$disk/media.`facter domain`
+    sudo chown `whoami`: /media/$disk/media.`facter domain`
+
+## NAS
+
+These commands should be enough to sync all media archives:
+
+    hydractl usb-enable  # run this for USB drives, then connect the disk
+    hydractl mount-media $MEDIA
+    hydractl sync-media  $MEDIA
+
+As this should handle syncing all backups:
+
+    hydractl sync-backups $MEDIA
+
+## TPC
+
+Chek the [specific](tpc.md) documentation for more information about TPCs.
+
+When regularly syncing a TPC, use a procedure that guarantees minimal
+changes in the running TPC, to make sure syncing data won't create
+inconsistencies in the destination, by doing something like:
+
+1. Reboot the machine
+2. Turn off networking.
+3. Log in through console.
+
+Then do the following:
+
+    hydractl usb-enable  # run this for USB drives, then connect the disk
+    hydractl mount-media $TPC
+    hydractl sync-tpc    $TPC
+
+To sync archives and remote backups, proceed with as explained in the NAS
+section.
+
+You may also want to consider using [borger][] ([mirror][]) to have encrypted
+homedir backups in the external archive/backup volume.
+
+[borger]: https://git.fluxo.info/borger/about/
+[mirror]: https://0xacab.org/rhatto/borger
+
+## Appliances
+
+You might want to backup the whole SSD, M-SATA or microSD from your appliances.
+If so, proceed as follows with the appliance device connected in your TPC:
+
+    export appliance=appliance-name
+    export dest="/var/backups/remote/$appliance.`facter domain`/image/`date +%Y%m%d`"
+    sudo mkdir -p $dest
+    dcfldd if=/dev/sdb | bzip2 > $dest/$appliance.img.bz2
+
+## Smartphone
+
+Smartphones usually have their own way to be backed up. This is an example
+based on the [android-backup][] utility:
+
+    android-backup <device-name>
+
+[android-backup]: https://git.fluxo.info/scripts/tree/android-backup
+
+## Hardware rotation
+
+It's recommended to rotate the current hardware in use in all
+places:
+
+* Backup disks.
+* Laptops, so they're not kept out of use (and/or especially the batteries).
+
+## Backup Kit
+
+A Backup Kit is a box with the following items:
+
+* External encrypted archive/backup disk.
+* Case for SSD transportation.
+* Laptop power adapter and cables.
+* Dockstation SATA/USB/M-2/microSD/etc (with power adapter).
+* USB power adapter and cable (including USB 2, USB 3 and USB C).
+* USB cables (USB 2, USB 3 and USB C) for the Dockstation and the external drive.
+* TPC laptop with battery and TPS (SSD, M-2 etc), optionally with a UltraBase/Dockstation.
+* Philips screwdriver and other tools.
+* FCR-MG2 adaptor for microSD to USB.
+* Anything else your need (like eyeglasses).
+* Everything in a sealed box.
+
+This may be the ultimate disaster recovery kit for your Hydra!
+
+## Restore
+
+Examples according to the software used to make the backup.
+
+### Duplicity
+
+For [duplicity][]:
+
+    duplicity collection-status file:///var/backups/duplicity
+    duplicity restore --file-to-restore home/$USER --time 2018-03-25 file:///var/backups/duplicity/ /home/$USER
+
+[duplicity]: https://duplicity.gitlab.io/
+
+### Borg
+
+For [Borg][]:
+
+    mkdir ~/temp/misc/restore
+    cd    ~/temp/misc/restore
+    borg list    ssh://$USER@$SERVER:$PORT//var/backups/users/$USER/borg
+    borg extract ssh://$USER@$SERVER:$PORT//var/backups/users/$USER/borg::$USER-2018-06-11T17:07:39 mnt/crypt/home/$USER/$FILE_OR_FOLDER
+
+Make sure to cleanup `~/temp/misc/restore` after recovering what you need.
+
+[Borg]: https://www.borgbackup.org/
+
+### eCryptfs
+
+For [eCryptfs][]:
+
+    sudo ecryptfs-recover-private /media/$MEDIA/home/.ecryptfs/$USER/.Private
+
+[eCryptfs]: https://www.ecryptfs.org/
diff --git a/docs/index.md b/docs/index.md
index e833e89..f52f3b4 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,10 +1,23 @@
 # Hydra Suite - Command and Control
 
 Hydra is a suite for orchestration and management of machines composed of
-the following basic commands:
+**lots of conventions and assumptions**, and the following basic commands:
 
 * `hydractl`: act in the current host.
 * `hydra`:    act on at set of hosts.
 * `hydras`:   act on a superset of hosts.
 
-Check also the [slides](slides) (portuguese only).
+An Hydra is not a "cloud computing" platform, it's something else: a set of
+systems that operate together, where any node can be used to spawn new nodes.
+
+This is an ongoing experiment is how a person or a collective can manage
+many computers in an unified way. It's not production ready, and it always
+struggles to pass the test of time.
+
+Running the Hydra Suite is not recommended at this point, except if you
+want to contribute with it's development.
+
+But studying it's documentation, code, conventions is concepts is highly
+encouraged, as it may give you some ideas to manage your own systems.
+
+Check also the [concept presentation](slides) (portuguese only).
diff --git a/docs/tpc.md b/docs/tpc.md
new file mode 100644
index 0000000..969b5bb
--- /dev/null
+++ b/docs/tpc.md
@@ -0,0 +1,380 @@
+# Trusted Personal Computers
+
+The Hydra Suite was made with the [Trusted Personal Computer (TPC)][]
+([portuguese translation][]) paradigm as it's starting point.
+
+This guide documents the lifecycle of a TPC storage device, or a "TPS
+Cartridge":
+
+    Cartridge = TPS = Trusted Personal Storage (like and SSD, microSD or M-2)
+
+The idea is that a number of TPCs can have interchangeable cartridges, as long
+as each cartridge has an unique name.
+
+[Trusted Personal Computer (TPC)]: https://web.archive.org/web/20180914153944/http://cmrg.fifthhorseman.net/wiki/TrustedPhysicalConsole
+[portuguese translation]: https://plano.autodefesa.org/specs/tpc.html
+
+## Parameters
+
+Start by running the following commands in your terminal, adjusting to your
+case:
+
+    export HYDRA="nome-da-hydra"
+    export VOLNAME="nome-do-disco"
+    export DOMAIN="dominio.example.org"
+    export DEVICE="/dev/sdb"
+    export USER=`whoami`
+    export DEST=/media/$VOLNAME
+    export CONFIG_FOLDER="`hydra $HYDRA folder`"
+
+    if [ "$USER" != "root" ]; then
+      export SUDO="sudo"
+    fi
+
+## Provisioning a new cartridge
+
+### Random data
+
+If you want to pre-fill your disk with random data, proceed as follows:
+
+    $SUDO dcfldd if=/dev/urandom of=$DEVICE
+
+This can be done in a NAS as it may take days to finish, and the rest of the
+procedures from this document can be done from another TPC.
+
+### Configuration
+
+If non-existing, create entries and keys:
+
+    hydra $HYDRA newnode $VOLNAME tpc
+
+Customize:
+
+    vim $CONFIG_FOLDER/config/provision/$VOLNAME.conf
+    vim $CONFIG_FOLDER/puppet/config/node/$VOLNAME.$DOMAIN.yaml
+    vim $CONFIG_FOLDER/puppet/config/secrets/node/$VOLNAME.$DOMAIN.yaml
+
+### Secrets
+
+Proceed adding other passwords and secrets at
+`$CONFIG_FOLDER/puppet/config/secrets/node/$VOLNAME.$DOMAIN`, make sure to
+encode them with [hiera-yaml][]:
+
+    hydra $HYDRA eyaml $VOLNAME encrypt -q -o block -p -l some::password
+
+If you already have the secret somewhere, you can use a construction like this
+which already adds the eyaml block into the hiera config file:
+
+    keyringer $HYDA decrypt /path/to/some/secret | \
+      hydra $HYDRA eyaml $VOLNAME encrypt -q -o block --sdtin -l some::password >> \
+      $CONFIG_FOLDER/puppet/config/secrets/node/$VOLNAME.$DOMAIN.yaml
+
+You can also ensure a fresh random passphrase is used, using your favourite
+generator like this:
+
+    head -c ${1:-20} /dev/urandom | base64 | \
+      hydra $HYDRA eyaml $VOLNAME encrypt -q -o block --sdtin -l some::random:password >> \
+      $CONFIG_FOLDER/puppet/config/secrets/node/$VOLNAME.$DOMAIN.yaml
+
+[hiera-yaml]: https://github.com/voxpupuli/hiera-eyaml
+
+### Installation
+
+The proceed with the system installation, which should create all volumes in
+the TPS and setup the base Operating System:
+
+    hydra $HYDRA provision $VOLNAME
+
+### Metadata
+
+After installation, make sure to save metadata from the disk layout and LUKS headers, which
+can be useful during recovery procedures.
+
+1. Write down UUIDS, models and serials from the new disk. Examples:
+
+        lsblk $DEVICE -n -o +UUID | keyringer $HYDRA encrypt nodes/$VOLNAME.$DOMAIN/lsblk
+        udevadm info --query=all --name=$DEVICE | keyringer $HYDRA encrypt nodes/$VOLNAME.$DOMAIN/udevadm
+
+        # For non-USB disks only
+        $SUDO hdparm -I $DEVICE   | keyringer $HYDRA encrypt nodes/$VOLNAME.$DOMAIN/hdparm
+        $SUDO smartctl -i $DEVICE | keyringer $HYDRA encrypt nodes/$VOLNAME.$DOMAIN/smartctl
+
+2. Save partition tables, the LUKS header and other relevant information:
+
+        $SUDO LC_ALL=C sfdisk -d $DEVICE | keyringer $HYDRA encrypt nodes/$VOLNAME.$DOMAIN/sfdisk
+
+        $SUDO cryptsetup luksDump /dev/mapper/$VOLNAME-root | keyringer $HYDRA encrypt nodes/houdini.fluxo.info/luksDump-root
+        $SUDO cryptsetup luksDump /dev/mapper/$VOLNAME-swap | keyringer $HYDRA encrypt nodes/houdini.fluxo.info/luksDump-swap
+
+        $SUDO cryptsetup luksHeaderBackup /dev/mapper/$VOLNAME-root --header-backup-file luksHeaderBackup-root
+        $SUDO chown $(whoami) luksHeaderBackup-root
+        keyringer $HYDRA encrypt nodes/$VOLNAME.$DOMAIN/luksHeaderBackup-root luksHeaderBackup-root
+        chmod +w luksHeaderBackup-root
+        wipe luksHeaderBackup-root
+
+## Other security measures
+
+* Optionally, configure ATA passphrases for the new disk. If so, make sure to
+  save the passphrase in the keyring:
+
+        keyringer $HYDRA encrypt nodes/$VOLNAME.$DOMAIN/ata
+
+## Mounting
+
+Use the following whenever you need to mount the cartridge in another system:
+
+    hydractl mount-media $VOLNAME
+
+This will make the volume available at `/media/$VOLNAME`.
+
+## Initial user
+
+These steps are needed to setup the encrypted home folder (the second level of encryption)
+before continuing the provisioning.
+
+### Setting up home encryption
+
+If you're running this in an existing hydra-compatible TPC but you don't have your
+home folder encrypted, backup your data and then proceed running
+
+    hydractl ecryptfs-home
+
+### Syncing the user and encrypted home in the new cartridge
+
+Then, with the new TPS cartridge mounted (`hydractl mount-media $VOLNAME`), do
+the following to replicate your user and homedir there:
+
+    $SUDO chroot $DEST adduser $USER
+    $SUDO chroot $DEST usermod -a -G sudo $USER
+    $SUDO chroot $DEST apt install ecryptfs-utils -y
+
+    $SUDO mkdir -p $DEST/mnt/crypt/home
+    $SUDO mv       $DEST/home/$USER           $DEST/mnt/crypt/home/$USER
+    $SUDO ln -s -t $DEST/home                 /mnt/crypt/home/$USER/
+    $SUDO ln -s -t $DEST/mnt/crypt/home/$USER /home/.ecryptfs/$USER/.ecryptfs
+    $SUDO ln -s -t $DEST/mnt/crypt/home/$USER /home/.ecryptfs/$USER/.Private
+
+    $SUDO chroot $DEST chown -R $USER: /mnt/crypt/home/$USER
+
+The procedure may be adapted if you're already running the system from the new TPS
+and is logged in there as `root`.
+
+## Syncing data
+
+From another system, and with the cartridge mounted:
+
+    hydractl sync-tpc $VOLNAME
+
+Check the [backups](backups.md) for additional information.
+
+## Unmounting
+
+Now that basic provisioning is completed, you can unmount the cartridge.
+
+From another system, and with the cartridge mounted:
+
+    hydractl umount-media $VOLNAME
+
+## Deploy
+
+Now it's time to boot the new system, log in with your user and deploy the complete
+configuration.
+
+The following command will take care of the deployment:
+
+    hydra $HYDRA deploy localhost
+
+## Archives and backups
+
+You can use a hydra-compatible archive/backup disk to setup working copies
+for existing archives:
+
+    export                 MEDIA=backup-disk-name
+    hydractl mount-media  $MEDIA
+    hydractl sync-backups $MEDIA
+    hydractl sync-media   $MEDIA
+
+    hydractl sync-media-initremotes localhost boxes hostname-nas1 hostname-nas2
+
+Then add manually other archive remotes.
+
+## Compile
+
+Make sure other nodes have some information on your cartridge by compiling
+collected data:
+
+    hydra $HYDRA compile
+
+## Adding a new hardware in the TPC pool
+
+* Proceed with [homologatin a new unit](https://plano.autodefesa.org/specs/tpc.html).
+* Provision, deploy, sync-media, sync-vms etc.
+* Add the devices' network MAC Addresses at `70-persistent-net.rules`, then make sure
+  to sync this in the other cartridges.
+
+## Decommissioning
+
+To be documented.
+
+## Additional references
+
+### Implementation
+
+These are implementation-specific references, especially issues, fixes and
+workarounds found while developing procedures for TPCs.
+
+#### UEFI
+
+Overview:
+
+* [UEFI boot: how does that actually work, then? | AdamW on Linux and more](https://www.happyassassin.net/posts/2014/01/25/uefi-boot-how-does-that-actually-work-then/ "UEFI boot: how does that actually work, then? | AdamW on Linux and more")
+* [Unified Extensible Firmware Interface - ArchWiki](https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface "Unified Extensible Firmware Interface - ArchWiki")
+* [Linux on UEFI: A Quick Installation Guide](https://www.rodsbooks.com/linux-uefi/ "Linux on UEFI: A Quick Installation Guide")
+
+Coreboot versus UEFI:
+
+* [Coreboot Versus UEFI](https://linuxhint.com/coreboot-vs-uefi/ "Coreboot Versus UEFI")
+
+UEFI versus Legacy:
+
+* [Linux: UEFI vs Legacy IDE. Pros/Cons/Security? : linuxquestions](https://www.reddit.com/r/linuxquestions/comments/6kw648/linux_uefi_vs_legacy_ide_prosconssecurity/ "Linux: UEFI vs Legacy IDE. Pros/Cons/Security? : linuxquestions")
+
+Lenovo:
+
+* [lenovo - UEFI or Legacy? Which is advised and why? - Ask Ubuntu](https://askubuntu.com/questions/647303/uefi-or-legacy-which-is-advised-and-why "lenovo - UEFI or Legacy? Which is advised and why? - Ask Ubuntu")
+* [Legacy BIOS boot support removed in Lenovo's 2020 products](https://support.lenovo.com/br/en/solutions/ht510878-legacy-bios-boot-support-removed-in-lenovo-2020-products "Access Denied")
+
+Issues:
+
+* [UEFI troubleshooting | Qubes OS](https://www.qubes-os.org/doc/uefi-troubleshooting/ "UEFI troubleshooting | Qubes OS")
+
+#### Boot loader
+
+Geral:
+
+* [GNU GRUB Manual 2.06: Installing GRUB using grub-install](https://www.gnu.org/software/grub/manual/grub/html_node/Installing-GRUB-using-grub_002dinstall.html#Installing-GRUB-using-grub_002dinstall "GNU GRUB Manual 2.06: Installing GRUB using grub-install")
+* [GRUB - ArchWiki](https://wiki.archlinux.org/title/GRUB#Default/fallback_boot_path "GRUB - ArchWiki")
+* [GRUB/Tips and tricks - ArchWiki](https://wiki.archlinux.org/title/GRUB/Tips_and_tricks#UEFI_further_reading "GRUB/Tips and tricks - ArchWiki")
+
+(Re)installation:
+
+* [GrubEFIReinstall - Debian Wiki](https://wiki.debian.org/GrubEFIReinstall "GrubEFIReinstall - Debian Wiki")
+* [Chapter 13. Encrypting block devices using LUKS Red Hat Enterprise Linux 8 | Red Hat Customer Portal](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/encrypting-block-devices-using-luks_security-hardening)
+
+Full Disk Encryption (FDE) support:
+
+* [How can I install Debian with full-disk encryption and a custom sized swapfile? - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/577379/how-can-i-install-debian-with-full-disk-encryption-and-a-custom-sized-swapfile "How can I install Debian with full-disk encryption and a custom sized swapfile? - Unix & Linux Stack Exchange")
+
+Recovery:
+
+* [GRUB Recovery for UEFI-GPT-LUKS-LVM](https://arnaudr.io/2018/03/26/grub-recovery-for-uefi-gpt-luks-lvm/ "Arnaud R")
+* [Re: Does grub-mkrescue support UEFI hybrid USB/DVD images?](https://lists.gnu.org/archive/html/grub-devel/2015-01/msg00042.html "Re: Does grub-mkrescue support UEFI hybrid USB/DVD images?")
+
+Issues:
+
+* [grub2 - UEFI Grub fails to boot encrypted Ubuntu 21.04 system: can't find command cryptomoun - Ask Ubuntu](https://askubuntu.com/questions/1351914/uefi-grub-fails-to-boot-encrypted-ubuntu-21-04-system-cant-find-command-crypt)
+  * [PSA: GRUB fails to detect the fact that / and /boot are LUKS encrypted : archlinux](https://www.reddit.com/r/archlinux/comments/o1opyj/psa_grub_fails_to_detect_the_fact_that_and_boot/ "PSA: GRUB fails to detect the fact that / and /boot are LUKS encrypted : archlinux")
+  * [grub2 - How do I get Grub to automatically run cryptomount to load its config file (encrypted boot) - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/313939/how-do-i-get-grub-to-automatically-run-cryptomount-to-load-its-config-file-encr "grub2 - How do I get Grub to automatically run cryptomount to load its config file (encrypted boot) - Unix & Linux Stack Exchange")
+  * [#917117 - grub-efi-amd64-signed: doesn't mount cryptodisk - Debian Bug report logs](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=917117 "#917117 - grub-efi-amd64-signed: doesn't mount cryptodisk - Debian Bug report logs")
+  * [GRUB + LUKS2 not asking for password](https://forum.artixlinux.org/index.php/topic,2093.0.html "GRUB + LUKS2 not asking for password")
+* [FS#40029 : [grub] ${cmdpath} expansion in GRUB shell is wrong](https://bugs.archlinux.org/task/40029 "FS#40029 : [grub] ${cmdpath} expansion in GRUB shell is wrong")
+  * [linux - How to reconfigure grub - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/577780/how-to-reconfigure-grub "linux - How to reconfigure grub - Unix & Linux Stack Exchange")
+  * [grub2 - wrong grub prefix (efi) `grub-install` and `update-grub` doesn't fix it - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/615109/wrong-grub-prefix-efi-grub-install-and-update-grub-doesnt-fix-it "grub2 - wrong grub prefix (efi) `grub-install` and `update-grub` doesn't fix it - Unix & Linux Stack Exchange")
+  * [#925309 - Wrong prefix directory hardcoded in signed GRUB image - Debian Bug report logs](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925309 "#925309 - Wrong prefix directory hardcoded in signed GRUB image - Debian Bug report logs")
+  * [grub2 - grub doesn't load grub.cfg automatically - Ask Ubuntu](https://askubuntu.com/questions/885445/grub-doesnt-load-grub-cfg-automatically "grub2 - grub doesn't load grub.cfg automatically - Ask Ubuntu")
+    * [ubuntu - Grub not loading config file or booting into linux automatically - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/232730/grub-not-loading-config-file-or-booting-into-linux-automatically#247716 "ubuntu - Grub not loading config file or booting into linux automatically - Unix & Linux Stack Exchange")
+
+#### SecureBoot
+
+* [SecureBoot - Debian Wiki](https://wiki.debian.org/SecureBoot "SecureBoot - Debian Wiki")
+  * [DEBAMAX — Debian expertise — Blog — An overview of Secure Boot in Debian](https://debamax.com/blog/2019/04/19/an-overview-of-secure-boot-in-debian/ "DEBAMAX — Debian expertise — Blog — An overview of Secure Boot in Debian")
+  * [Debian -- GRUB2 UEFI SecureBoot vulnerabilities - 2021](https://www.debian.org/security/2021-GRUB-UEFI-SecureBoot/ "Debian -- GRUB2 UEFI SecureBoot vulnerabilities - 2021")
+  * [SecureBoot/Discussion - Debian Wiki](https://wiki.debian.org/SecureBoot/Discussion "SecureBoot/Discussion - Debian Wiki")
+  * [SecureBoot/VirtualMachine - Debian Wiki](https://wiki.debian.org/SecureBoot/VirtualMachine "SecureBoot/VirtualMachine - Debian Wiki")
+  * [Frequently asked questions (FAQ) | Qubes OS](https://www.qubes-os.org/faq/#is-secure-boot-supported "Frequently asked questions (FAQ) | Qubes OS")
+    * [Heads - Trammell Hudson's Projects](https://trmm.net/Heads/ "Heads - Trammell Hudson's Projects")
+    * [About - Heads - Wiki](https://osresearch.net/ "About - Heads - Wiki")
+  * [GitHub - osresearch/safeboot: Scripts to slightly improve the security of the Linux boot process with UEFI Secure Boot and TPM support](https://github.com/osresearch/safeboot "GitHub - osresearch/safeboot: Scripts to slightly improve the security of the Linux boot process with UEFI Secure Boot and TPM support")
+    * [Xen / Qubes support · Issue #21 · osresearch/safeboot · GitHub](https://github.com/osresearch/safeboot/issues/21 "Xen / Qubes support · Issue #21 · osresearch/safeboot · GitHub")
+  * [Debian-GNU-Linux-Profiles/build-secureboot-trustchain.md at master · hardenedlinux/Debian-GNU-Linux-Profiles · GitHub](https://github.com/hardenedlinux/Debian-GNU-Linux-Profiles/blob/master/docs/hardened_boot/build-secureboot-trustchain.md "Debian-GNU-Linux-Profiles/build-secureboot-trustchain.md at master · hardenedlinux/Debian-GNU-Linux-Profiles · GitHub")
+  * [Secure Boot with GRUB 2 and signed Linux images and initrds](https://ruderich.org/simon/notes/secure-boot-with-grub-and-signed-linux-and-initrd "Secure Boot with GRUB 2 and signed Linux images and initrds")
+
+#### Evil Maid Attack
+
+* [Evil maid attack - Wikipedia](https://en.wikipedia.org/wiki/Evil_maid_attack "Evil maid attack - Wikipedia")
+  * [Anti-Evil Maid with UEFI and Xen - Brendan Kerrigan, Assured Information Security - Platform Security Summit 2018](https://www.platformsecuritysummit.com/2018/speaker/kerrigan/ "Anti-Evil Maid with UEFI and Xen - Brendan Kerrigan, Assured Information Security - Platform Security Summit 2018")
+    * [PSEC2018-Anti-Evil-Maid-UEFI-Xen-Brendan-Kerrigan.pdf](https://www.platformsecuritysummit.com/2018/speaker/kerrigan/PSEC2018-Anti-Evil-Maid-UEFI-Xen-Brendan-Kerrigan.pdf "PSEC2018-Anti-Evil-Maid-UEFI-Xen-Brendan-Kerrigan.pdf")
+  * [F-Secure Whitepaper - Evil Maid Guide (English).pdf](https://www.f-secure.com/content/dam/press/de/media-library/reports/F-Secure%20Whitepaper%20-%20Evil%20Maid%20Guide%20(English).pdf "F-Secure Whitepaper - Evil Maid Guide (English).pdf")
+  * [UEFI threats moving to the ESP: Introducing ESPecter bootkit | WeLiveSecurity](https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/ "UEFI threats moving to the ESP: Introducing ESPecter bootkit | WeLiveSecurity")
+  * [disk encryption - Encrypting the /boot partition in a Linux system can protect from an Evil Maid Attack? - Information Security Stack Exchange](https://security.stackexchange.com/questions/166075/encrypting-the-boot-partition-in-a-linux-system-can-protect-from-an-evil-maid-a "disk encryption - Encrypting the /boot partition in a Linux system can protect from an Evil Maid Attack? - Information Security Stack Exchange")
+    * [Ten Immutable Laws Of Security (Version 2.0) | Microsoft Docs](https://docs.microsoft.com/en-us/archive/blogs/rhalbheer/ten-immutable-laws-of-security-version-2-0 "Ten Immutable Laws Of Security (Version 2.0) | Microsoft Docs")
+  * [seagl-2017.pdf](https://ia600805.us.archive.org/7/items/seagl-2017/seagl-2017.pdf "seagl-2017.pdf")
+  * [GitHub - kritjo/Techniques-for-Secure-System-Boot: Paper for mid-semester exam in IN2120 at Institute for Informathics, University of Oslo. Ended up scoring 98,8%.](https://github.com/kritjo/Techniques-for-Secure-System-Boot "GitHub - kritjo/Techniques-for-Secure-System-Boot: Paper for mid-semester exam in IN2120 at Institute for Informathics, University of Oslo. Ended up scoring 98,8%.")
+  * [GitHub - xmikos/cryptboot: Encrypted boot partition manager with UEFI Secure Boot support](https://github.com/xmikos/cryptboot "GitHub - xmikos/cryptboot: Encrypted boot partition manager with UEFI Secure Boot support")
+  * [Arch Linux Full-Disk Encryption Installation Guide [Encrypted Boot, UEFI, NVMe, Evil Maid] · GitHub](https://gist.github.com/m-bartlett/3ff47b31947cd1e504268415c8054f50 "Arch Linux Full-Disk Encryption Installation Guide [Encrypted Boot, UEFI, NVMe, Evil Maid] · GitHub")
+  * [GitHub - QubesOS/qubes-antievilmaid: Qubes component: antievilmaid](https://github.com/QubesOS/qubes-antievilmaid "GitHub - QubesOS/qubes-antievilmaid: Qubes component: antievilmaid")
+  * [Secure Boot, TPM2, LUKS, and a potential security hole in the Wiki / GNU/Linux Discussion / Arch Linux Forums](https://bbs.archlinux.org/viewtopic.php?id=271423 "Secure Boot, TPM2, LUKS, and a potential security hole in the Wiki / GNU/Linux Discussion / Arch Linux Forums")
+  * [luks - Defending against the evil maid, how to handle removal of the /boot partition - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/189412/defending-against-the-evil-maid-how-to-handle-removal-of-the-boot-partition "luks - Defending against the evil maid, how to handle removal of the /boot partition - Unix & Linux Stack Exchange")
+  * [Multiple encryption - Wikipedia](https://en.wikipedia.org/wiki/Multiple_encryption "Multiple encryption - Wikipedia")
+
+#### Howtos
+
+* [Creating a BIOS/GPT and UEFI/GPT Grub-bootable Linux system - Philipp's Tech Blog](https://blog.heckel.io/2017/05/28/creating-a-bios-gpt-and-uefi-gpt-grub-bootable-linux-system/ "Creating a BIOS/GPT and UEFI/GPT Grub-bootable Linux system - Philipp's Tech Blog")
+  * [How to Install GRUB2 with EFI Support | Timesys LinuxLink](https://linuxlink.timesys.com/docs/engineering/wiki/HOWTO_Install_GRUB2_with_EFI_support "How to Install GRUB2 with EFI Support | Timesys LinuxLink")
+  * [Real full disk encryption using GRUB on Arch Linux for BIOS and UEFI](https://unixsheikh.com/tutorials/real-full-disk-encryption-using-grub-on-arch-linux-for-bios-and-uefi.html "Real full disk encryption using GRUB on Arch Linux for BIOS and UEFI")
+  * [Real full disk encryption using GRUB on Debian GNU/Linux for BIOS](https://unixsheikh.com/tutorials/real-full-disk-encryption-using-grub-on-debian-linux-for-bios.html "Real full disk encryption using GRUB on Debian GNU/Linux for BIOS")
+  * [Real full disk encryption using GRUB on Void Linux for BIOS](https://unixsheikh.com/tutorials/real-full-disk-encryption-using-grub-on-void-linux-for-bios.html "Real full disk encryption using GRUB on Void Linux for BIOS")
+  * [Install Debian with Debootstrap + Grub EFI · GitHub](https://gist.github.com/superboum/1c7adcd967d3e15dfbd30d04b9ae6144 "Install Debian with Debootstrap + Grub EFI · GitHub")
+  * [Debian: Debootstrap Install (aka Installing Debian “the Arch Way”) – LeCorbeau's Vault](https://lecorbeausvault.wordpress.com/2021/10/07/debian-debootstrap-install-aka-installing-debian-the-arch-way/ "Debian: Debootstrap Install (aka Installing Debian “the Arch Way”) – LeCorbeau's Vault")
+    * [Debian -- Details of package arch-install-scripts in bullseye](https://packages.debian.org/bullseye/arch-install-scripts "Debian -- Details of package arch-install-scripts in bullseye")
+  * [Instructions how to install Debian using debootstrap · GitHub](https://gist.github.com/varqox/42e213b6b2dde2b636ef "Instructions how to install Debian using debootstrap · GitHub")
+
+#### TRIM
+
+* [Trim (computing) - Wikipedia](https://en.wikipedia.org/wiki/Trim_(computing) "Trim (computing) - Wikipedia")
+  * [fstrim.pdf](https://people.redhat.com/mskinner/rhug/q1.2014/fstrim.pdf "fstrim.pdf")
+  * [Enable periodic TRIM - including on a LUKS partition - Tech Knowledge Base - jaytaala.com Confluence](https://confluence.jaytaala.com/display/TKB/Enable+periodic+TRIM+-+including+on+a+LUKS+partition "Enable periodic TRIM - including on a LUKS partition - Tech Knowledge Base - jaytaala.com Confluence")
+  * [How to properly activate TRIM for your SSD on Linux: fstrim, lvm and dm-crypt | synaptic fault](http://blog.neutrino.es/2013/howto-properly-activate-trim-for-your-ssd-on-linux-fstrim-lvm-and-dmcrypt/ "How to properly activate TRIM for your SSD on Linux: fstrim, lvm and dm-crypt | synaptic fault")
+  * [ssd - fstrim doesn't seem to trim a partition that uses lvm and dm-crypt - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/346195/fstrim-doesnt-seem-to-trim-a-partition-that-uses-lvm-and-dm-crypt#348016 "ssd - fstrim doesn't seem to trim a partition that uses lvm and dm-crypt - Unix & Linux Stack Exchange")
+  * [ssd - Trim with LVM and dm-crypt - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/85865/trim-with-lvm-and-dm-crypt "ssd - Trim with LVM and dm-crypt - Unix & Linux Stack Exchange")
+  * [[SOLVED] fstrim with LVM on LUKS: discard operation not supported / Installation / Arch Linux Forums](https://bbs.archlinux.org/viewtopic.php?id=231086 "[SOLVED] fstrim with LVM on LUKS: discard operation not supported / Installation / Arch Linux Forums")
+  * [Linux/LUKS/Full Disk Encryption: How can I mitigate SSD/flash media security security risk caused by unreliable physical deletion? - Information Security Stack Exchange](https://security.stackexchange.com/questions/248917/linux-luks-full-disk-encryption-how-can-i-mitigate-ssd-flash-media-security-sec "Linux/LUKS/Full Disk Encryption: How can I mitigate SSD/flash media security security risk caused by unreliable physical deletion? - Information Security Stack Exchange")
+  * [linux - How to enable discards on encrypted root - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/574400/how-to-enable-discards-on-encrypted-root "linux - How to enable discards on encrypted root - Unix & Linux Stack Exchange")
+  * [SSD - Gentoo Wiki](https://wiki.gentoo.org/wiki/SSD#Discard_.28trim.29_support "SSD - Gentoo Wiki")
+    * [ssd - What exactly do the 'allow-discards' and 'root_trim' Linux parameters do? - Ask Ubuntu](https://askubuntu.com/questions/243518/what-exactly-do-the-allow-discards-and-root-trim-linux-parameters-do "ssd - What exactly do the 'allow-discards' and 'root_trim' Linux parameters do? - Ask Ubuntu")
+  * [Solid state drive - ArchWiki](https://wiki.archlinux.org/title/Solid_state_drive "Solid state drive - ArchWiki")
+  * [TRIM on LVM on LUKS on SSD – Just another Linux geek](https://blog.christophersmart.com/2013/06/05/trim-on-lvm-on-luks-on-ssd/ "TRIM on LVM on LUKS on SSD – Just another Linux geek")
+  * [Possible to get SSD TRIM (discard) working on ext4 + LVM + software RAID in Linux? - Server Fault](https://serverfault.com/questions/227918/possible-to-get-ssd-trim-discard-working-on-ext4-lvm-software-raid-in-linu "Possible to get SSD TRIM (discard) working on ext4 + LVM + software RAID in Linux? - Server Fault")
+  * [Discard (TRIM) with KVM Virtual Machines... in 2020! - Chris Irwin's Blog](https://chrisirwin.ca/posts/discard-with-kvm-2020/ "Discard (TRIM) with KVM Virtual Machines... in 2020! - Chris Irwin's Blog")
+  * [Implementing Linux fstrim on SSD with software md-raid - Server Fault](https://serverfault.com/questions/508459/implementing-linux-fstrim-on-ssd-with-software-md-raid#508463 "Implementing Linux fstrim on SSD with software md-raid - Server Fault")
+    * [Implementing Linux fstrim on SSD with software md-raid - Ringing Liberty](https://www.ringingliberty.com/2013/05/16/implementing-linux-fstrim-on-ssd-with-software-md-raid/ "Implementing Linux fstrim on SSD with software md-raid - Ringing Liberty")
+    * [ubuntu - Why does fstrim trim all of the free space on my mdraid mirror after a reboot? - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/124293/why-does-fstrim-trim-all-of-the-free-space-on-my-mdraid-mirror-after-a-reboot "ubuntu - Why does fstrim trim all of the free space on my mdraid mirror after a reboot? - Unix & Linux Stack Exchange")
+    * [How to set up SSD raid and TRIM support? - Ask Ubuntu](https://askubuntu.com/questions/264625/how-to-set-up-ssd-raid-and-trim-support "How to set up SSD raid and TRIM support? - Ask Ubuntu")
+  * [Debian, QEMU, libvirt, qcow2 and fstrim – #Jan](https://jschumacher.info/2020/11/debian-qemu-libvirt-qcow2-and-fstrim/ "Debian, QEMU, libvirt, qcow2 and fstrim – #Jan")
+    * [Discard (TRIM) with KVM Virtual Machines... in 2020! - Chris Irwin's Blog](https://chrisirwin.ca/posts/discard-with-kvm-2020/ "Discard (TRIM) with KVM Virtual Machines... in 2020! - Chris Irwin's Blog")
+      * [Discard (TRIM) with KVM Virtual Machines - Chris Irwin's Blog](https://chrisirwin.ca/posts/discard-with-kvm/ "Discard (TRIM) with KVM Virtual Machines - Chris Irwin's Blog")
+    * [TRIM Support on KVM Virtual Machines – ZenCoffee Blog – random notes, guides, and thoughts…](http://blog.zencoffee.org/2016/05/trim-support-kvm-virtual-machines/ "TRIM Support on KVM Virtual Machines – ZenCoffee Blog – random notes, guides, and thoughts…")
+    * [#763318 - qemu-kvm: discard='unmap' not working for qcow2 disks on virtio-scsi controller - Debian Bug report logs](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=763318 "#763318 - qemu-kvm: discard='unmap' not working for qcow2 disks on virtio-scsi controller - Debian Bug report logs")
+    * [linux - Qemu TRIM and discard on a physical SSD device - Server Fault](https://serverfault.com/questions/896448/qemu-trim-and-discard-on-a-physical-ssd-device "linux - Qemu TRIM and discard on a physical SSD device - Server Fault")
+  * [Milan Broz's blog: TRIM & dm-crypt ... problems?](https://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html "Milan Broz's blog: TRIM & dm-crypt ... problems?")
+    * [#11870 (Add solid state drives to some servers) – Support](https://support.mayfirst.org/ticket/11870 "#11870 (Add solid state drives to some servers) – Support")
+
+#### Swap
+
+* [Swap (and hibernation) on SSD in 2019?](https://askubuntu.com/questions/1165507/swap-and-hibernation-on-ssd-in-2019#1165544)
+  * [Why are swap partitions discouraged on SSD drives, are they harmful? - Ask Ubuntu](https://askubuntu.com/questions/652337/why-are-swap-partitions-discouraged-on-ssd-drives-are-they-harmful?noredirect=1&lq=1 "Why are swap partitions discouraged on SSD drives, are they harmful? - Ask Ubuntu")
+  * [Swap (and hibernation) on SSD in 2019? - Ask Ubuntu](https://askubuntu.com/questions/1165507/swap-and-hibernation-on-ssd-in-2019 "Swap (and hibernation) on SSD in 2019? - Ask Ubuntu")
+  * [Swap and SSD linux - Unix & Linux Stack Exchange](https://unix.stackexchange.com/questions/589598/swap-and-ssd-linux "Swap and SSD linux - Unix & Linux Stack Exchange")
+
+#### Cryptsetup
+
+* [Debian Cryptsetup docs – README](https://cryptsetup-team.pages.debian.net/cryptsetup/README.initramfs.html "Debian Cryptsetup docs – README")
+  * [partitioning - Should I use LUKS1 or LUKS2 for partition encryption? - Ask Ubuntu](https://askubuntu.com/questions/1032546/should-i-use-luks1-or-luks2-for-partition-encryption "partitioning - Should I use LUKS1 or LUKS2 for partition encryption? - Ask Ubuntu")
+    * [devconf2016-luks2.pdf](https://mbroz.fedorapeople.org/talks/DevConf2016/devconf2016-luks2.pdf "devconf2016-luks2.pdf")
+    * [Cracking LUKS/dm-crypt passphrases – Diverto – Information Security Warriors](https://diverto.github.io/2019/11/18/Cracking-LUKS-passphrases "Cracking LUKS/dm-crypt passphrases – Diverto – Information Security Warriors")
+  * [#671037 - can not change target name of root in /etc/crypttab - Debian Bug report logs](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=671037 "#671037 - can not change target name of root in /etc/crypttab - Debian Bug report logs")
+  * [Debian -- Details of package cryptsetup-initramfs in bullseye](https://packages.debian.org/bullseye/cryptsetup-initramfs "Debian -- Details of package cryptsetup-initramfs in bullseye")
+
+#### Certification
+
+* [Certified hardware | Qubes OS](https://www.qubes-os.org/doc/certified-hardware/ "Certified hardware | Qubes OS")