I want to set up a headless GNU/Linux (Ubuntu 20.04) PC with full disk encryption, with the ability to unlock the disks either with a USB drive, or by entering a passphrase by keyboard. My starting point is a fresh install using the basic full disk encryption option in the installer, which manages everything besides /boot as a LUKS-encrypted logical volume group and gives me the keyboard option.
It would be ideal to me if I could simply have a small USB stick containing a passphrase that will unlock the disks. Not only would that be handy for servers (where you could leave the USB stick in the server - the goal is to be able to return broken harddisks without having to worry about confidential data), it would also be great for my laptop: Insert the USB stick when booting and remove it after unlocking the cryptodisk. And if the USB-disk breaks, use the keyboard.
How can this be done in a way that will work on a system that runs
(And if this question seems familiar it is due to: https://stackoverflow.com/a/23451824/363028 - which solved the problem, but is incompatible with systemd.)
On my non-systemd system I use this patch https://gitlab.com/ole.tange/tangetools/tree/master/decrypt-root-with-usb
It searches the root dir of all devices for the file 'cryptkey.txt' and try decrypting with each line as a key. If that fails: Revert to typing in the pass phrase.
And it works exactly how I want, but systemd breaks this, so I cannot use this (at least not directly).