Fedora on The Solutions Are Known

Decrypting Disks without Passwords on Reboot

Tue, 08 Sep 2026 00:05:01 -0400

Like many tech hobbyists, I run a fair number of servers and VMs at home, and a lot of them hold data I would rather keep encrypted. Drives and SSDs eventually fail (you should have backups, but that is an entry for another day) and sometimes get stolen. If the data is encrypted, both are far less stressful events.

The catch is that encrypted data has to be decrypted before it is useful. The usual model, typical of Linux’s LUKS encryption, is that someone types a passphrase at boot after every power failure or maintenance window. LUKS can instead tie the key to the machine’s TPM, much as Windows BitLocker does, but that is less effective for VMs and does little if the TPM is stolen along with the drive. A passphrase at boot has real security advantages. Its serious disadvantage is that a person has to be present to type it, every time.

Constructing this Site

Mon, 07 Sep 2026 12:49:08 -0400

I had been considering a blog for a while, mostly to hold what I have learned about various things. I did not want to relearn those hard-won bits of knowledge the next time I needed them, so I kept a private collection of notes. I also believe sharing is a good thing, and I wanted to make those notes available to anyone who might find them useful.

Choosing Hugo

While working with Gramps, I became aware of one of its developers, David Straub. When he revamped his personal website, I learned of Hugo, which met my list of criteria for a blog system and was similar to what he described.

Local Fedora Mirror

Sun, 06 Sep 2026 01:50:01 -0400

If you maintain more than a few Fedora systems, having each machine download the same updates through your internet connection can waste time and bandwidth. A local repository mirror lets you download those packages once to your network and reuse them. It can also serve any locally produced packages to your systems although that is not implemented in the script below.

Planning

This script is a deliberately simple setup, not the Fedora MirrorManager Mirror Management System which may be more appropriate depending on what you are doing. This script can be hosted on a physical or virtual server. Mirroring the actively updated repositories can take upwards of 550 GiB as configured below, so it is probably worth giving it its own drive. Whether that is part of the root filesystem or a dedicated mount, the script and steps below assume that storage is at /opt/mirror.

Using Gramps Web Sync on Fedora

Sun, 06 Sep 2026 01:20:21 -0400

When using Gramps Web Sync on Fedora’s GNOME desktop to keep Gramps and a Gramps Web tree in sync, it helps to let the GNOME password manager remember the password. That is not entirely straightforward. You need the Python keyring library to save the sync password, but it defaults to the KWallet backend even when GNOME is the default desktop. This is tracked in this bug.

The workaround:

Install python3-keyring and python3-secretstorage.
Create ~/.config/python_keyring/keyringrc.cfg to make the Secret Service backend (which GNOME Keyring implements) the default, as described in the keyring documentation on configuring a backend.

sudo dnf --refresh install python3-secretstorage python3-keyring
mkdir -p ~/.config/python_keyring
cat > ~/.config/python_keyring/keyringrc.cfg <<'CFG'
[backend]
default-keyring=keyring.backends.SecretService.Keyring
CFG

Run the mkdir and cat commands as your own user, not with sudo, since the file belongs in your home directory.