V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_3200_partitioning/3220_partition_encryption.sh

@@ -10,8 +10,6 @@
 # SPDX-PackageName: CISS.debian.installer
 # SPDX-Security-Contact: security@coresecret.eu
 
-# TODO: LUKS Header Cloud Backup
-
 guard_sourcing
 
 #######################################
@@ -27,14 +25,19 @@ guard_sourcing
 #   HMP_PATH_ENCLABEL
 #   HMP_PATH_FSUUID
 #   HMP_PATH_LUKSUUID
+#   VAR_CRYPT_BOOT
 #   VAR_CRYPT_RECOVERY
 #   VAR_CRYPT_ROOT
+#   VAR_FINAL_FQDN
 #   VAR_ITER_TIME
 #   VAR_KDF_ITERATIONS
 #   VAR_KDF_MEMORY
 #   VAR_KDF_THREADS
+#   VAR_LUKS_BACKUP
+#   VAR_LUKS_URL
 #   VAR_RECIPE_STRING
 #   VAR_SETUP_PART
+#   VAR_TEMP_PLAIN_NC_AUTH
 # Arguments:
 #   None
 # Returns:
@@ -42,8 +45,8 @@ guard_sourcing
 #######################################
 partition_encryption() {
   ### Declare Arrays, HashMaps, and Variables.
-  declare -Ag HMP_PATH_LUKSUUID      # Used in: 3290() - [Mount Path:LUKS UUID].
-                                     # Used in: 4210() - [Mount Path:LUKS UUID].
+  declare -Ag HMP_PATH_LUKSUUID # Used in: 3290() - [Mount Path:LUKS UUID].
+      # Used in: 4210() - [Mount Path:LUKS UUID].
   declare -Ag HMP_PATH_FSUUID        # Used in: 3240() - [Mount Path:Filesystem UUID].
                                      # Used in: 3290() - [Mount Path:Filesystem UUID].
                                      # Used in: 4200() - [Mount Path:Filesystem UUID].
@@ -60,10 +63,18 @@ partition_encryption() {
               var_encryption_ephemeral="" var_encryption_integrity="" var_encryption_cipher="" var_encryption_hash="" \
               var_encryption_key="" var_encryption_label="" var_encryption_meta="" var_encryption_slot="" \
               var_encryption_pbkdf="" var_encryption_rng="" var_filesystem_label="" var_mount_path="" var_uuid="" var_fs="" \
-              var_fs_uuid=""
+              var_fs_uuid="" var_luks_backup_file="" var_luks_backup_name=""
 
   declare -a  ary_luks_opts=()
 
+  if [[ -n "${VAR_LUKS_URL}" ]]; then
+
+    VAR_LUKS_URL=${VAR_LUKS_URL%/}
+    read_luks_backup_token
+    do_log "debug" "file_only" "3220() Command: [read_luks_backup_token]"
+
+  fi
+
   for var_encryption_path in "${ARY_CRYPT_MOUNT_PATHS[@]}"; do
 
     ### Initialize Arrays and Variables
@@ -174,10 +185,37 @@ partition_encryption() {
 
     fi
 
-    cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}.bak" "/dev/${var_dev}"
-    do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}.bak'."
+    if [[ "${VAR_LUKS_BACKUP}" == "true" ]]; then
 
-    ### Opening encrypted container.
+      var_luks_backup_file="${DIR_BAK}/luks_header_${var_dev}.bak"
+      var_luks_backup_name="${VAR_FINAL_FQDN}_luks_header_${var_dev}.bak"
+      cryptsetup luksHeaderBackup --header-backup-file="${var_luks_backup_file}" "/dev/${var_dev}"
+      do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}' LUKS Header saved: '${var_luks_backup_file}'."
+
+      if [[ -n "${VAR_LUKS_URL}" ]]; then
+
+        guard_trace on
+
+        if curl --retry 2 "${VAR_LUKS_URL}/public.php/webdav/${var_luks_backup_name}" \
+          --upload-file "${var_luks_backup_file}" --user "${VAR_TEMP_PLAIN_NC_AUTH}" > /dev/null 2>&1; then
+
+          do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}' LUKS Header upload: '${VAR_LUKS_URL}' successful."
+
+        else
+
+          do_log "warn" "file_only" "3220() Partition: '/dev/${var_dev}' LUKS Header upload: '${VAR_LUKS_URL}' failed."
+
+        fi
+
+        guard_trace off
+
+        rm -f "${var_luks_backup_file}"
+
+      fi
+
+    fi
+
+    ### Opening the encrypted container.
     if [[ "${var_encryption_path,,}" == "/boot" ]]; then
       cryptsetup luksOpen "/dev/${var_dev}" \
         --key-file="${DIR_CNF}/password_luks_boot.txt" \
@@ -207,9 +245,43 @@ partition_encryption() {
 
   done
 
+  [[ -n "${VAR_LUKS_URL}" ]] && unset VAR_TEMP_PLAIN_NC_AUTH
+
   guard_dir && return 0
 }
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
 readonly -f partition_encryption
+
+#######################################
+# Reads the Nextcloud auth token from '${DIR_CNF}/password_luks_backup.txt' into VAR_TEMP_PLAIN_NC_AUTH
+# Globals:
+#   DIR_CNF
+#   VAR_TEMP_PLAIN_NC_AUTH
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   ERR_READ_AUTH_FILE: on failure
+#######################################
+read_luks_backup_token(){
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -r var_luks_backup_auth="${DIR_CNF}/password_luks_backup.txt"
+  declare -g VAR_TEMP_PLAIN_NC_AUTH=""
+
+  guard_trace on
+
+  if ! read_password_file "${var_luks_backup_auth}" VAR_TEMP_PLAIN_NC_AUTH; then
+
+    return "${ERR_READ_AUTH_FILE}"
+
+  fi
+
+  guard_trace off
+
+  return 0
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f read_luks_backup_token
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh