To answer my own question I have made the following experiment on a spare hard disk. Be sure to have a valid and restorable backup. These commands can irretrievably destroy valuable data if e.g. applied to the wrong device.
Creating the test system
First we need two partitions to work with, I created them with fdisk to get:
Device Boot Start End Sectors Size Id Type
/dev/sda1 2048 20973567 20971520 10G 83 Linux
/dev/sda2 20973568 41945087 20971520 10G 83 Linux
Then I created an unencrypted btrfs raid1 (you need to force with -f if the partitions are used, but be sure you know what you are doing):
> mkfs.btrfs -m raid1 -d raid1 /dev/sda1 /dev/sda2
...
Devices:
ID SIZE PATH
1 10.00GiB /dev/sda1
2 10.00GiB /dev/sda2
Then I mounted the filesystem to have a live system to work with, and created a test file:
> mount /dev/sda1 /mnt/tmp
> echo "Hello World" > /mnt/tmp/hello.txt
Doing the migration
First resize the filesystem so we can later replace the devices with the smaller encrypted versions.
> btrfs fi resize 1:9G /mnt/tmp
> btrfs fi resize 2:9G /mnt/tmp
Then we remove the duplication in the system (needs to be forced because it increases the risk of data loss). This takes a long time on a large file system, as it rewrites all the data. We can check the progress with btrfs balance status /mnt/tmp
.
> btrfs balance start -mconvert=single -dconvert=single /mnt/tmp --force
Done, had to relocate 3 out of 3 chunks
Then we can remove one of the devices. If this takes long, we can check the status using btrfs device usage /mnt/tmp
.
> btrfs device remove 1 /mnt/tmp
> btrfs device usage /mnt/tmp
/dev/sda2, ID: 2
Device size: 10.00GiB
Device slack: 1.00GiB
Data,single: 1.00GiB
Metadata,single: 256.00MiB
System,single: 32.00MiB
Unallocated: 7.72GiB
Then we convert it to a LUKS device
> cryptsetup luksFormat /dev/sda1
> cryptsetup luksOpen /dev/sda1 crypt_1
We add the encrypted device to the filesystem and remove the other one
> btrfs device add /dev/mapper/crypt_1 /mnt/tmp
> btrfs device remove /dev/sda2 /mnt/tmp
This will again take a long time for a filesystem with a lot of data, as all data have to be moved.
We then convert the other device to LUKS, add it back to the filesystem and rebalance as Raid1:
> cryptsetup luksFormat /dev/sda2
> cryptsetup luksOpen /dev/sda2 crypt_2
> btrfs device add /dev/mapper/crypt_2 /mnt/tmp
> btrfs balance start -dconvert=raid1 -mconvert=raid1 /mnt/tmp
Done, had to relocate 3 out of 3 chunks
Of course the last command will again take a long time if we have a lot of data. Let's check the result:
> btrfs filesystem show /mnt/tmp
Label: none uuid: e894df1a-b62f-49cb-bcdc-8e6eb25945a4
Total devices 2 FS bytes used 448.00KiB
devid 3 size 9.98GiB used 1.28GiB path /dev/mapper/crypt_1
devid 4 size 9.98GiB used 1.28GiB path /dev/mapper/crypt_2
> btrfs filesystem df /mnt/tmp
Data, RAID1: total=1.00GiB, used=320.00KiB
System, RAID1: total=32.00MiB, used=16.00KiB
Metadata, RAID1: total=256.00MiB, used=112.00KiB
GlobalReserve, single: total=16.00MiB, used=0.00B
Voilá, we have a RAID 1 on two encrypted devices, still containing our data!
> cat /mnt/tmp/hello.txt
Hello World