Zfs: Question: Any plans for supporting keylocation=https://

[geek-at]

I tried to implement a system where ZFS gets the encryption key from a local HTTP server (as described in the official oracle docs) but creating it using zfs create -o encryption=on -o keylocation=https://mykeyserver/keyforthisserver -o keyformat=raw data/enc fails with

cannot create 'data/enc2': invalid keylocation

Are there any plans on implementing it? For now I'll just mount the key via nfs and use the file:///path method

[behlendorf]

Yes, this functionality is planned. There's an initial patch for FreeBSD which uses libfetch. It needs to be adapted for Linux to use libcurl or another library.

[electricboogie]

Perhaps it should be noted that zfs-load-key will accept a key piped from std-out, so you can use curl to direct its output to a pipe to achieve a similar result. I use something similar (smbget) and a systemd service to load the keys when the network is up.

[electricboogie]

Excuse me, I'm not sure this works for raw keys, but it does work for passphrases with the keylocation set to "prompt."