Userdata Encryption

Florist images have a split partition setup where the rootis separate from user data, encrypting the rootfs is useless as the image shouldn't contain anything confidential. Instead florist allows encrypting user data with clevis for automatic TPM2 decryption. This encrypts the entire mutable part of Gardenhouse which includes /var, /etc and /home

No extra configuration is required in the Gardenhouse profile to enable this. Except for clevis decryption, in which case clevis will have to be installed.

Gardenhouse will automatically discover and decrypt the luks volume with label USERDATA. It may be generated with the following command:

# cryptsetup luksFormat --label USERDATA /dev/<disk>