Volatile volumes with ephemeral encryption keys

[cfcs]

I've been meaning for a while to split out volatile volume creation:

• To avoid them appearing in recursive backups
• and to enable them to be encrypted with one-time encryption keys.

I think it would both be easier to manage and to do backups of.

I currently have this awk snippet in /etc/cron.daily/ that should probably go in tools/; it takes daily snapshots and excludes the volatile volumes:

#!/usr/bin/env bash

day="$(date --iso-8601)"
for f in $(zfs list -p | awk '!/^[^\t ]+volatile / { print $1 }')
    zfs snapshot "${f}@cron-$day"
    zfs hold "$day" "${f}@cron-$day"
done

With separate locations we could just use zfs snapshot -r and zfs send -r; that would be nice.

[DemiMarie]

The encryption part is now a core feature of Qubes OS.