How to create a data-redundant encrypted filesystem on an external SSD?

Question

What's the easiest way to format an external SSD with encryption and RAID1-style data replication?

As I recently grew suspicious of my SSD+luks+btrfs setup, I've started wondering how to reduce risk of data loss in certain infrequently used external disks of mine.

While the btrfs and dm-crypt documentation is very helpful, I would prefer to use a method with reasonable defaults that I can trust to evolve over time, without having to study the entire matter from scratch each time.

Ideally, the solution would involve blivet-gui, as I would like to have a better understanding of it since it's used by the Fedora installer.

Answer 1

From kernel 4.5, this can be done after filesystem creation. Just create a single btrfs volume with blivet-gui in the usual way (with encryption), and then use btrfs-balance / convert to switch the data to a DUP profile after the partition has been created and mounted, like:

sudo btrfs balance start -mconvert=dup /run/media/<path>
sudo btrfs balance start -dconvert=dup /run/media/<path>

After writing some files you'll then see something like:

$ lsblk | tail -n3
sdf                      8:80   0 232,9G  0 disk  
└─sdf1                   8:81   0 232,9G  0 part  
  └─luks-<UUID>        253:7    0 232,9G  0 crypt /run/media/<path>
$ sudo btrfs filesystem df /run/media/<path>
Data, DUP: total=108.00GiB, used=106.64GiB
System, DUP: total=32.00MiB, used=16.00KiB
Metadata, DUP: total=2.00GiB, used=169.94MiB
GlobalReserve, single: total=131.78MiB, used=0.00B

Of course, dup is no substitute for backups or even RAID1 across two distinct physical devices. See the warnings at dup profiles on a single device:

Whether there are really 2 physical copies highly depends on the underlying device type. For example, a SSD drive can remap the blocks internally to a single copy--thus deduplicating them. This negates the purpose of increased redundancy and just wastes filesystem space without providing the expected level of redundancy.

So, deduplication probably helps more on an HDD than on an SSD. It's also not clear how encryption affects deduplication and wear-leveling techniques.