How do I get Grub to automatically run cryptomount to load its config file (encrypted boot)

Question

So I'm trying to get a fully encrypted boot partition going. I'm running Funtoo, but mostly drawing from the Arch wiki for help.

So I decided to do something crazy/controversial: not separate boot/root partitions. My setup looks like so:

/dev/nvme0n1p1  - EFI parition
/dev/nvme0n1p2  - Swap
/dev/nvme0n1p3  - Encrypted /

In my /etc/default/grub I have the following:

GRUB_ENABLE_CRYPTODISK=y
GRUB_PRELOAD_MODULES="luks cryptodisk"
GRUB_CMDLINE_LINUX="luks enc_root=/dev/nvme0n1p3 root=/dev/mapper/enc_root"

All the linux arguments are for better-initramfs. I include a key to the file system within the ramdisk so it doesn't prompt me for my password twice.

I installed Grub using the following:

grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id="Funtoo Linux [GRUB]" --recheck --boot-directory=/boot/efi/EFI

So in its current state, I get a Grub rescue prompt. It can't find its configuration file (it's on the encrypted boot/root disk). So I run the following commands:

insmod luks
cryptomount (hd1,gpt3)
set root=(crypto0)
configfile (crypto)/boot/grub/grub.cfg

..and I have a fully booting/working system! :)

So my question is: how to I configure the Grub EFI loader to attempt automatically load the encrypted partition to (crypt0) and read its configuration file?

Note: Grub identifies the disk as (hd1,gpt3) most likely because my USB stick is still plugged in. That should change to (hd0,gpt3) if I unplug it and reboot.

Solution

Turns out on Gentoo/Funtoo, the device mapper for grub isn't enabled by default. I added the following to /etc/portage/package.use:

sys-boot/grub device-mapper

Then I re-emerged grub, ran grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id="Funtoo Linux [GRUB]" --recheck and rebooted to find a luks password request screen. After typing it in, everything booted perfectly.

Special thanks to frostschutz who provided the solution in this thread:

https://forums.gentoo.org/viewtopic.php?p=7972812#7972812

Comments

[shaheen]

what would be a similar solution for ubuntu? it's unclear to me what Gentoo's device-mapper does here. how does it impact grub's early boot sequence?