Hello

I built my custom server image with LUKS encryption and everything was fine with regards to the encrytped rootfs on emmc. However I ran into boot failure issues when I tried adding other disks with LUKS encryption (because I had moved /var to new LUKS disk). After some time spent in debugging and recovery it turned out that my custom built Armbian never ran systemd-cryptsetup-generator to dynamically generate the systemd units needed to unlock encrypted volumes during boot and hence failed to correctly setup and hit the corresponding cryptsetup.target

Finally I ended up installing package systemd-cryptsetup manually and run systemd-cryptsetup-generator to resolve it (auto-generate the target unit files - update-initramfs after editing /etc/crypttab should trigger it, but in this case the package itself was missing?), and it cost me a few hours troubleshooting why... (more so because I was determined not to introduce a manual hack/override for something that should not be broken in the first place).

I think by default Armbian build framework should include the systemd-cryptsetup package (for both server and minimal), when CRYPTROOT_ENABLE is set - as encryption is a basic default configuration these days..

Thanks

PS: At this point I have forgotten the reasons I had deduced why cryptroot worked and only the additional LUKS disks were impacted. But in any case the ask/fix is small - the Armbian build environment should include package systemd-cryptsetup by default without having to resort to extensions or userpatches ...

Edited November 4Nov 4 by Raul

On 11/3/2026 at 1:01 PM, Raul said:

I think by default Armbian build framework should include the systemd-cryptsetup package

You are right.

https://github.com/armbian/build/pull/11300/changes

Feel free to open PR next time. Otherwise its missed.

PS
I made many improvements to LUKS encryption lately. One desktop variant is going to be released (v26.11) with a default encrypted rootfs.

Thanks. Jut thinking - Maybe it’s better that the topic is validated via a forum thread before opening PR rather than create junk PR clutter due to mistaken notions … ?

2 hours ago, Raul said:

Maybe it’s better that the topic is validated via a forum thread before opening PR rather than create junk PR clutter due to mistaken notions … ?

Absolutly. There are lots of PR's coming up lately.

For cryptoroot stuff i am doing two things:
- automatic recrypt at first boot when autokey is used (set at build time)

- support for encrypted rootfs in armbian-install

systemd-cryptsetup package doesn't change / help in this in any way AFAIK.