Encrypted root partition with LUKS
Full-disk encryption for the SD card, from mclbn's 2023 guide to bjornVallem's Trixie/CM5 version that shows the passphrase prompt on the built-in screen.
What it takes
- Software only
- Config change
Difficulty 2 of 3 — moderate.
Details
mclbn's original guide (November 2023) encrypts the root partition with LUKS2 (XChaCha20-Adiantum, gentler on the CM4 than AES) from a second Linux machine, rebuilds the initramfs with cryptsetup, and warns that the built-in display cannot show the initramfs prompt — you unlock over HDMI. The Bookworm update (February 2025) adds a post-install hook so new kernels rebuild the initramfs and patches the LUKS2 unlock in initramfs.
bjornVallem's Trixie guide (March 2026, tested on a CM5 only) uses AES-XTS-256 with Argon2id, takes about 30 minutes, and includes the display modules and an init script so the passphrase prompt appears on the LCD. warszawa's older thread on encrypting only /home points to fscrypt as the lighter alternative.
Links
Open at Forum threadRelated mods
Run a Meshtastic node on the console itself: meshtasticd drives the AIO's SX1262 over SPI, with the graphical MUI, the web UI or the Contact TUI client on top.
On Rex's images a single apt install gives you SDR++ for the AIO's RTL-SDR or a USB dongle; his AIO package adds the sdrpp-brown fork.
Rex's ClockworkPi-RetroPie image (Pi-Gen, EmulationStation, RetroArch) is the working answer; the Debian install and gamepad threads fill in the rest.
jutleys booted a prepared Windows 95 disk image in RetroArch's DOSBox-X core with working mouse buttons; plain DOSBox on the A-06 needs output=opengl to behave.
Two receivers, two recipes: the 4G card's GNSS via AT+CGPS on /dev/ttyUSB3, or the AIO's GPS on the serial port (/dev/ttyS0 CM4, /dev/ttyAMA0 CM5) at 9600 baud.
The AIO's PCF85063A keeps time off-grid once the right overlay is in config.txt — and on a CM5 the built-in fake RTC has to be switched off first.