hetzner-dracut-sshd/README.md

# hetzner-dracut-sshd

🚧 **Work in progress** 🚧

Post-install script for Hetzner's `installimage` that installs `dracut-sshd` to enable remote LUKS
unlocking via SSH.

This is tested with Rocky Linux 10. It should also work with AlmaLinux 10 and possibly earlier
releases, but these have not been tested.

Not written by Hetzner, it's written *for* (installing Rocky Linux servers at) Hetzner.


## Notes

- The script assumes a setup with LVM on LUKS on RAID1, but this is not a strict requirement. Other
  setups may require small changes to the script.
- Configures the initramfs to enable networking (e.g. NetworkManager) in early boot
  - `dracut-network`, NetworkManager in the initramfs and `rd.neednet=1` in the kernel cmdline
  - Reuses the static IP configuration that `installimage` configures (via `dracut-network`)
- Enables EPEL (required for `dracut-sshd`)
- Installs `dracut-sshd`
  - Uses the SSH keys in `/root/.ssh/authorized_keys`, as previously installed by `installimage`
- Always check `/root/postinstall_debug.txt` after `installimage` ran.

### After rebooting out of the rescue system

- The system reboots again after first boot due to SELinux autorelabeling. That means that you will
  need to ssh into the initrd to unlock *twice* if it's the first time.

### Troubleshooting

- Always check `/root/postinstall_debug.txt` after `postinstall` ran.
- It's not specific to this postinstall script, but make sure you know how to mount an encrypted
  system from the rescue disk using `mdadm`, `cryptsetup`, `lvscan` etc. Also remember to `touch
  /path-to/mounted-system/.autorelabel` after tinkering, to not break booting due to SELinux
  choking on unlabeled files.
- Be sure to regenerate your initramfs if you changed anything substantial, e.g. NetworkManager
  configuration.
✨ Initial commit 2026-09-15 19:59:19 +02:00			`# hetzner-dracut-sshd`

			`🚧 Work in progress 🚧`

🐛 Switch back to NetworkManager We must not rely on DHCP and use installimage's static NetworkManager configuration. While we could try to read the NM configuration and configure systemd-networkd, we decided against it, as NetworkManager is the default on Rocky Linux. Configure dracut/the initramfs to a. include NetworkManager and b. that we need networking in early boot (rd.neednet=1). Closes gh-1. Closes gh-3. 2026-09-16 21:59:08 +02:00			Post-install script for Hetzner's `installimage` that installs `dracut-sshd` to enable remote LUKS
			`unlocking via SSH.`

			`This is tested with Rocky Linux 10. It should also work with AlmaLinux 10 and possibly earlier`
			`releases, but these have not been tested.`

📝 README: Not by Hetzner 2026-09-16 22:44:08 +02:00			`Not written by Hetzner, it's written for (installing Rocky Linux servers at) Hetzner.`

✨ Initial commit 2026-09-15 19:59:19 +02:00
			`## Notes`

🐛 Switch back to NetworkManager We must not rely on DHCP and use installimage's static NetworkManager configuration. While we could try to read the NM configuration and configure systemd-networkd, we decided against it, as NetworkManager is the default on Rocky Linux. Configure dracut/the initramfs to a. include NetworkManager and b. that we need networking in early boot (rd.neednet=1). Closes gh-1. Closes gh-3. 2026-09-16 21:59:08 +02:00			`- The script assumes a setup with LVM on LUKS on RAID1, but this is not a strict requirement. Other`
			`setups may require small changes to the script.`
			`- Configures the initramfs to enable networking (e.g. NetworkManager) in early boot`
			- `dracut-network`, NetworkManager in the initramfs and `rd.neednet=1` in the kernel cmdline
📝 README: Explicitly mention that dracut-network uses NM config 2026-09-16 22:39:19 +02:00			- Reuses the static IP configuration that `installimage` configures (via `dracut-network`)
🐛 Switch back to NetworkManager We must not rely on DHCP and use installimage's static NetworkManager configuration. While we could try to read the NM configuration and configure systemd-networkd, we decided against it, as NetworkManager is the default on Rocky Linux. Configure dracut/the initramfs to a. include NetworkManager and b. that we need networking in early boot (rd.neednet=1). Closes gh-1. Closes gh-3. 2026-09-16 21:59:08 +02:00			- Enables EPEL (required for `dracut-sshd`)
🎨 README: Small markup fix 2026-09-15 20:07:39 +02:00			- Installs `dracut-sshd`
✨ Initial commit 2026-09-15 19:59:19 +02:00			- Uses the SSH keys in `/root/.ssh/authorized_keys`, as previously installed by `installimage`
🐛 Switch back to NetworkManager We must not rely on DHCP and use installimage's static NetworkManager configuration. While we could try to read the NM configuration and configure systemd-networkd, we decided against it, as NetworkManager is the default on Rocky Linux. Configure dracut/the initramfs to a. include NetworkManager and b. that we need networking in early boot (rd.neednet=1). Closes gh-1. Closes gh-3. 2026-09-16 21:59:08 +02:00			- Always check `/root/postinstall_debug.txt` after `installimage` ran.

			`### After rebooting out of the rescue system`

			`- The system reboots again after first boot due to SELinux autorelabeling. That means that you will`
			`need to ssh into the initrd to unlock twice if it's the first time.`

			`### Troubleshooting`

			- Always check `/root/postinstall_debug.txt` after `postinstall` ran.
📝 README: Fix typo and re-word a bit 2026-09-16 22:07:44 +02:00			`- It's not specific to this postinstall script, but make sure you know how to mount an encrypted`
🐛 Switch back to NetworkManager We must not rely on DHCP and use installimage's static NetworkManager configuration. While we could try to read the NM configuration and configure systemd-networkd, we decided against it, as NetworkManager is the default on Rocky Linux. Configure dracut/the initramfs to a. include NetworkManager and b. that we need networking in early boot (rd.neednet=1). Closes gh-1. Closes gh-3. 2026-09-16 21:59:08 +02:00			system from the rescue disk using `mdadm`, `cryptsetup`, `lvscan` etc. Also remember to `touch
📝 README: Fix markdown 2026-09-16 22:41:32 +02:00			/path-to/mounted-system/.autorelabel` after tinkering, to not break booting due to SELinux
📝 README: Fix typo and re-word a bit 2026-09-16 22:07:44 +02:00			`choking on unlabeled files.`
📝 README: Mention regenerating the initramfs 2026-09-16 22:39:46 +02:00			`- Be sure to regenerate your initramfs if you changed anything substantial, e.g. NetworkManager`
			`configuration.`