The algorithm for encrypted partition is a bit different, follow [secondary storage : Example setup of second drive](https://doc.qubes-os.org/en/latest/user/advanced-topics/secondary-storage.html#example-setup-of-second-drive) until you end up with an auto-mounted luks partition, after that continue with the step 2. | ### Booting with encrypted devices
On qubes, `systemd-cryptsetup` handles decryption during boot. It always tries available passphrases before prompting the user for a password. If you have multiple partitions with the same passphrase, you'll only need to enter it once.
If, on the other hand, you want to have multiple partitions with different passphrases unlocked during boot, you will encounter the fact that qubes splash screen doesn't tell what you're currently unlocking. It does not matter. You can enter passphrases in any order, `systemd-cryptsetup` will figure out what goes where by itself. Even with that, it might be hard to figure out what's going on if you make a typo in one of your passphrases, so let's get more information printed anyway.
There are two ways to print the device name when prompted for a passphrase during boot:
[details="Make plymouth (program responsible for the splash screen) print the device name"]
Idk, feel free to contribute... [This topic](https://forum.qubes-os.org/t/has-anyone-worked-with-plymouth-splash-animations-with-qubes-os/14188) might be a good starting point
[/details]
[details="Disable plymouth, enjoy the beauty of the console"]
1. Add the following parameters to `GRUB_CMDLINE_LINUX` in `/etc/default/grub`:
```
rd.plymouth=0 plymouth.enable=0
```
1. Generate the config:
```
# If you're using BIOS
grub2-mkconfig -o /boot/grub2/grub.cfg
# If you're using UEFI
grub2-mkconfig -o /boot/efi/EFI/qubes/grub.cfg
```
This disables plymouth and leaves you with concise console output and prompts. If you want verbose console during boot, you can remove `quiet` parameter from `GRUB_CMDLINE_LINUX`.
[/details]
Alternatively, if you don't want to do any of these, but get stuck entering passphrases, you can simply press ESC to exit into console.
### Notes
As is, with disabled plymouth, you'll end up with UUIDs of devices in the passphrase prompt. I think you can assign aliases to partitions in `/etc/crypttab` instead... |