====== encrypted ======

Consider fill with random data [[https://niziak.spox.org/wiki/linux:fs:luks#fill_with_random_data]]

<code bash>
cryptsetup luksFormat --cipher aes-xts-plain64 --key-size 512 --hash sha512 --sector-size 4096 --verify-passphrase --use-random /dev/nvme0n1p4
blkid /dev/nvme0n1p4
</code>

Consider [[https://wiki.niziak.spox.org/linux:backup:luks|luks header backup]]

<file ini /etc/crypttab>
home2 UUID=aad5d877-2bc5-460b-8441-32b89c0462e6 none luks,noearly,noauto,loud,discard
</file>

<code bash>
cryptdisk_start home2
dmsetup table

mkfs.btrfs /dev/mapper/home2
mkdir /home2
mount /dev/mapper/home2 /home2
cd home2
btrfs sub create @home
cd ..
umount /home2
cryptdisks_stop home2
</code>

<file ini /etc/fstab>
/dev/mapper/home2 /home2               btrfs   noauto,noatime,nodiratime,relatime,subvol=@home 0       0
</file>


<code bash>
systemctl daemon-reload

cryptdisks_start home2
mount /home2
...
umount /home2
cryptdisks_stop home2

update-initramfs -u -k all
</code>