Feature Request: Add Remote Disk Unlock Support for Wake-on-LAN Boot

[hngrdev]

Summary

I'd like to use my Omarchy desktop as a remote gaming machine and boot it via Wake-on-LAN. However, the encrypted root disk currently cannot be unlocked remotely, preventing the system from completing boot without physical interaction. This makes fully headless or remote-first usage impossible.

Problem

• Wake-on-LAN successfully powers on the system.
• The boot sequence stops at the disk encryption prompt.
• There is no mechanism to provide the LUKS passphrase remotely during early boot.
• This blocks remote workflows such as remote gaming, remote maintenance, or off-site access.
• To preserve the benefits of disk encryption, the machine must be powered off when not in use — keeping it running 24/7 is not desirable, especially without the physical presence of the owner. Without remote unlock, powering it back on is not possible.

Preferred Solution

Implement a remote unlock mechanism based on paragraph 3 described here:

Arch Wiki → dm-crypt → Specialties → Remote unlocking of root (or other) partition
https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote_unlocking_of_root_(or_other)_partition

This involves:

• Using a network-enabled initramfs environment
• Running an SSH (or similar) service in early boot
• Providing the unlock passphrase over that secure channel
• Passing it to the initramfs unlock mechanism

Opt-In Consideration

Adopting this may mean losing Plymouth’s nice boot/decrypt UI, so this should remain fully opt-in and not replace the current default setup.

Ideal outcome

A script or helper that automatically:

1. Sets up the initramfs environment as per paragraph 3 (we'd need to choose the best method here)
2. Configures early boot networking
3. Enables the remote-unlock service
4. Provides a clean way to send the passphrase remotely

This would allow users to enable remote disk unlocking with minimal manual configuration.

Why This Matters

Remote gaming setups and other remote-first workflows depend on being able to fully boot the system after Wake-on-LAN without needing local interaction.
Being able to power the machine off when not in use (for security and power savings) while still being able to boot it remotely with disk encryption intact is essential for this use case.

[hngrdev]

Update: Got it to work using the method explained in this wiki page https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote_unlocking_of_root_(or_other)_partition at paragraph 3.2

I had to remove the plymouth hook and the splash kernel cmdline, so I can confirm that we lose the nice UI on boot

I'll start working on a setup script if there's any interest in the community

[markmcnaughton]

Could you possibly post your hooks and limine changes? I did this a while back, it worked but quite often, it simply wouldn't allow me to enter my password manually unless I disconnected the network cable. I'm assuming it was caused by the DHCP timeout settings I was trying to use not working. I got annoyed and disabled it.

My use case is a bit odd, I have 3 workstations which double up as additional Kubernetes nodes. They're shut down when I'm not using them to save power, however I like to start them remotely when needed, using my phone. I know Arch and Omarchy isn't really meant for servers, but I've been doing it for years (Arch at least). This is my test / home lab. I don't want to disable disk encryption for security reasons.

[thelifeandtimes]

I am also running into this issue for a workstation of mine. In most cases it is fine to boot and run, but it also runs my local LLMs and serves as my personal server so being able to reboot and access remotely (either on my LAN because I like to be lazy and sit on my couch or whatnot, or over Tailscale) would be very useful. I don't even care much about saving power...