Re: How to salvage a degraded mdadm RAID1 with as little data loss as possible?
David Christensen <[email protected]>
| Newsgroups | gmane.linux.debian.user |
|---|---|
| Message-ID | <[email protected]> |
On 6/23/26 01:22, [email protected] wrote: > On Tue, Jun 23, 2026 at 08:00:11AM +0200, Michel Verdier wrote: >> On 2026-06-22, [email protected] wrote: >>> On 6/21/26 23:18, Michel Verdier wrote: >>>> RAID is always before LUKS : partition > RAID array > LUKS > filesystem >>> >>> "Is always" means for you "should always be" or "has to be"? >> >> "has to be". LUKS encrypt a partition in a unique way. So 2 encrypted >> partitions are always different and cannot be synced. > > I think that is wrong. +1 Both configurations work, but have different performance and security considerations: * partitions > RAID > encryption > filesystem Will encrypt the RAID virtual block device, saving CPU cycles and requiring one passphrase and/or key. * partitions > encryption > RAID > filesystem Will encrypt each partition, arguably improving security but requiring more CPU cycles and passphrases/ keys. My SOHO file server uses ZFS, which combines RAID > filesystem. (ZFS native encryption has issues, so I avoid it.) So, the file server must use a variation of the above latter I/O layering configuration: partitions > encryption > ZFS David