one encrypted VG on multiple physical devices

Question

I have a problem with my Linux setup under Debian Bullseye. To avoid getting shot in the leg with an unstable distribution, I want to use lvcreate to create COW-snapshots, which I can roll back if necessary.

I run a one TB NVME and a two TB hard disk. All media is fully encrypted. The NVME has an unencrypted boot partition. The root partition is part of the volume group. The output of sudo pvs is

PV                          VG        Fmt  Attr PSize   PFree
/dev/dm-3                   vg-name lvm2 a--   <1.82t 1.77t
/dev/mapper/nvme0n1p2_crypt vg-name lvm2 a--  931.15g    0 

The two TB hard disk is divided that only as much space is occupied as I need. About one TB are not allocated. The NVME and the two TB hard disk are together in one volume group. My /etc/crypttab looks like

data_crypt UUID=2xxxx /etc/keyfile luks,initramfs
nvme0n1p2_crypt UUID=0xxx none luks,initramfs,discard

The output of sudo lvs is

LV     VG        Attr       LSize   Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
home   vg-name -wi-ao---- 896.15g                                                    
lvsnap vg-name swi-aos---  25.00g      root   75.17                                  
lvswap vg-name -wi-a-----  25.00g                                                    
root   vg-name owi-aos---  25.00g                                                    
swap  vg-name -wi-ao----  10.00g        

After entering the password to decrypt nvme0n1p2_crypt, I get the output that a UUID can not be found. After a timeout I end up in a Busybox. Here I execute the following commands

cryptsetup open /dev/sda data_crypt 
Password: ***

This section is very long, so I usually put it in the background with CTRG+Z and bg. Nevertheless the decryption is successful. Afterwards I run vgchange -ay to see all LV of the VG. cryptsetup status data_crypt shows me that the crypto LV was successfully decrypted.

Finally I leave the Busybox with exit. The booting of the system continues and I can log in.

I had already changed the order of the devices in the /etc/cryptsetup. The result was that nothing changed. I was asked for the password of nvme0n1p2_crypt first and complained about the missing LV before the query for data_crypt came.

I also tried to change my crypttab to

data_crypt UUID=2xxxx none luks,initramfs
nvme0n1p2_crypt UUID=0xxx none luks,initramfs,discard

and was running sudo update-initramfs -u -k all after it.

The result was, that I saw twice the password question. After the first I got a warning and that the last time it was writing to /dev/mapper/data. Then I inserted the password for data_crypt. It was very slow. After around five minutes the kernel printed adding target dm-6 caused an alignment inconsistency: physical_block_size = … logical block size… […] and it stucked there, so a clean login via tty was not able.