New machine mandos¶

Mandos is a means to give LUKS keys to machines that want to boot but have an encrypted rootfs.

Here's how you add a new client to our setup:

make sure the machine's clock in the BIOS is set correctly, as an incorrect clock may prevent the LUKS key from being decrypted.
add a new key to the LUKS partition and prepare mandos snippet:
```
   lsblk --fs &&
   read -p 'encrypted (root/lvm/..) device (e.g. /dev/sda2 or /dev/mb/pv_nvme): ' DEVICE &&
   apt install -y mandos-client &&
   (grep 116.203.128.207 /etc/mandos/plugin-runner.conf || echo '--options-for=mandos-client:--connect=116.203.128.207:16283' | tee -a /etc/mandos/plugin-runner.conf) &&
   umask 077 &&
   t=`tempfile` &&
   LC_ALL=C tr -d '\000' < /dev/random | dd bs=1 count=128 of="$t" &&
   cryptsetup luksAddKey $DEVICE "$t" &&
   mandos-keygen --passfile "$t"
```
Note that there may be the need to instruct mandos-client to use a specific network interface. If that's the case, set something like this in /etc/mandos/plugins-running.conf:
```
--options-for=mandos-client:--connect=116.203.128.207:16283,--interface=eno2
```
Replace eno2 with the appropriate interface name and note the comma separating the options passed to mandos-client (i.e. don't use spaces there!).

If there's more than one encrypted partition that needs to be unlocked in initramfs, you can (1) add the same key generated by the snippet above to the other partition(s) and (2) use the [keyscript=decrypt_keyctl][] (Debian-specific) option in /etc/crypttab to cache the passphrase sent by Mandos and automatically use it to decrypt the other partitions.
add the roles::fde class to new host in Puppet and run puppet there:
```
  puppet agent -t
```
If the class was already applied on a previous Puppet run, ensure the initramfs image is updated at this point:
```
  update-initramfs -u
```
on the mandos server, add the output of mandos-keygen from above to /etc/mandos/clients.conf and restart the service:
```
  service mandos restart
```
on the mandos server, update the firewall after you added the host to ldap:
```
  puppet agent -t
```
on the mandos server, enable the node:
```
  mandos-ctl --enable $FQDN
```
reboot the new host to test unlocking

TODO: Mandos setups should be automatic, see issue 40096.