NixOS ❄: Remote unlock of encrypted ZFS over Tailscale

Tue, 03 Nov 2026 22:00:00 +0100

This is a follow-up to my earlier post: Remote unlock of encrypted ZFS over SSH.

That setup has one limitation: the SSH server in the initrd is only reachable on my local network. If my file server reboots while I’m away, for a power cut or a kernel update, it just sits there waiting for passphrases until I get home. I could forward a port on my router, but I really don’t want an SSH server exposed to the internet, and certainly not one running in an initrd.

Tailscale on Elis Hirwing

NixOS ❄: Remote unlock of encrypted ZFS over Tailscale