@forgezero/agent 0.1.134 → 0.1.136

package/dist/fz.js

@@ -6007,7 +6007,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.134";
+var VERSION2 = "0.1.136";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -10816,7 +10816,7 @@ function validateBuiltInProvider(requirement2, where) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -10830,6 +10830,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION3 = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail2(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail2 = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -11465,7 +11472,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -11562,11 +11572,13 @@ function compileDeployment(sourceValue) {
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail2(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
       const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
-      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "diskEncryption", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
       integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
       integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
       integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
       integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      if (provisionedResources.diskEncryption !== undefined && !["none", "luks2"].includes(String(provisionedResources.diskEncryption)))
+        fail2(`deployment.spec.targets.${targetName}.provisioning.resources.diskEncryption`, "must be none or luks2.");
       integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
       integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
       if (typeof provisionedResources.confidential !== "boolean")
@@ -11796,6 +11808,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,
@@ -11888,6 +11901,7 @@ function initCoordinates(options) {
   const isolation = options.isolation ?? (runtime === "kata-snp" ? "sev-snp" : "standard");
   const operatingSystem = options.operatingSystem ?? (isolation === "sev-snp" ? "ubuntu-26.04" : "ubuntu-24.04");
   const result = {
+    branch: options.branch ?? "main",
     runtime,
     isolation,
     operatingSystem,
@@ -11901,6 +11915,9 @@ function initCoordinates(options) {
   };
   if (!/^[a-z][a-z0-9-]{0,62}$/.test(result.profile))
     throw new Error("deployment profile must be a lowercase typed name");
+  if (result.branch.length < 1 || result.branch.length > 255 || result.branch === "@" || result.branch.startsWith("/") || result.branch.endsWith("/") || result.branch.startsWith(".") || result.branch.endsWith(".") || result.branch.endsWith(".lock") || result.branch.includes("..") || result.branch.includes("//") || result.branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(result.branch)) {
+    throw new Error("deployment branch must be one exact valid Git branch name");
+  }
   if (!Number.isSafeInteger(result.replicas) || result.replicas < 1 || result.replicas > 1024)
     throw new Error("deployment replicas must be an integer from 1 to 1024");
   if (!Number.isSafeInteger(result.cpuCores) || result.cpuCores < 1 || result.cpuCores > 1024)
@@ -11930,7 +11947,7 @@ function initCoordinates(options) {
       if (!/^[a-z][a-z0-9-]{0,62}$/.test(value))
         throw new Error(`deployment provisioning ${label} must be a lowercase typed name`);
     const resources = options.provisioning.resources;
-    for (const [label, value] of Object.entries(resources).filter(([key]) => key !== "confidential")) {
+    for (const [label, value] of Object.entries(resources).filter(([key]) => !["confidential", "diskEncryption"].includes(key))) {
       if (!Number.isSafeInteger(value) || Number(value) < 0)
         throw new Error(`deployment provisioning ${label} must be a non-negative integer`);
     }
@@ -11939,6 +11956,8 @@ function initCoordinates(options) {
     }
     if (result.isolation === "sev-snp" && !resources.confidential)
       throw new Error("deployment provisioning must provide confidential capacity for sev-snp");
+    if (resources.diskEncryption !== undefined && !["none", "luks2"].includes(resources.diskEncryption))
+      throw new Error("deployment provisioning disk encryption mode is unsupported");
     if (!/^\d{1,18}$/.test(options.provisioning.monthlyAmountCents))
       throw new Error("deployment provisioning monthly amount must be a bounded USD-cent amount");
     if (!/^\d{1,18}$/.test(options.provisioning.maxMonthlySpendMinor))
@@ -11950,7 +11969,10 @@ function initCoordinates(options) {
     if (options.provisioning.metalHostname && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(options.provisioning.metalHostname))
       throw new Error("deployment provisioning metal hostname is invalid");
   }
-  return { ...result, ...options.provisioning ? { provisioning: options.provisioning } : {} };
+  return { ...result, ...options.provisioning ? { provisioning: {
+    ...options.provisioning,
+    resources: { ...options.provisioning.resources, diskEncryption: options.provisioning.resources.diskEncryption ?? "luks2" }
+  } } : {} };
 }
 function defaultTypeScriptDeployment(name, options = {}) {
   const selected = initCoordinates(options);
@@ -12019,6 +12041,7 @@ export default defineDeployment({
 	kind: 'Deployment',
 	metadata: { name: '${safeName2(name)}' },
 	spec: {
+		source: { branch: '${selected.branch}' },
 		security: { attestation: '${selected.isolation === "sev-snp" ? "required" : "preferred"}' },
 		targets: {
 			app: target.compute({
@@ -12414,6 +12437,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer2(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer2(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer2(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer2(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -12425,6 +12452,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -12455,6 +12483,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -12544,6 +12573,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",
@@ -15850,6 +15880,7 @@ function strictBootstrapDocument(value) {
           "vcpu",
           "memoryGib",
           "diskGib",
+          "diskEncryption",
           "egressGuaranteedMbps",
           "egressBurstMbps",
           "confidential",
@@ -17084,6 +17115,7 @@ async function applyMetalBootstrap(config, options) {
     "qemu-utils",
     "cloud-image-utils",
     "lvm2",
+    "cryptsetup",
     "nftables",
     "curl",
     "ca-certificates"
@@ -17518,11 +17550,12 @@ var validateMetalRequestValue = (value, options = {}) => {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential"
     ], label);
-    if (typeof row2.name !== "string" || typeof row2.address !== "string" || typeof row2.imageKey !== "string" || row2.cpuPoolKey !== undefined && typeof row2.cpuPoolKey !== "string" || !["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps"].every((key) => typeof row2[key] === "number") || typeof row2.confidential !== "boolean") {
+    if (typeof row2.name !== "string" || typeof row2.address !== "string" || typeof row2.imageKey !== "string" || row2.cpuPoolKey !== undefined && typeof row2.cpuPoolKey !== "string" || !["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps"].every((key) => typeof row2[key] === "number") || row2.diskEncryption !== undefined && !["none", "luks2"].includes(row2.diskEncryption) || typeof row2.confidential !== "boolean") {
       throw new Error(`${label} has invalid resource coordinates`);
     }
     return {
@@ -17534,6 +17567,7 @@ var validateMetalRequestValue = (value, options = {}) => {
       vcpu: row2.vcpu,
       memoryGib: row2.memoryGib,
       diskGib: row2.diskGib,
+      diskEncryption: row2.diskEncryption ?? "none",
       egressGuaranteedMbps: row2.egressGuaranteedMbps,
       egressBurstMbps: row2.egressBurstMbps,
       confidential: row2.confidential
@@ -19137,6 +19171,13 @@ function parseOptions(argv2) {
     } else if (token === "--provision-metal") {
       options.deployProvisionMetal = argv2[++index];
       options.deployInitCustomized = true;
+    } else if (token === "--provision-disk-encryption") {
+      const value = argv2[++index];
+      options.deployInitCustomized = true;
+      if (value === "none" || value === "luks2")
+        options.deployProvisionDiskEncryption = value;
+      else
+        options.optionError = "--provision-disk-encryption must be none or luks2.";
     } else if (["--provision-physical-cores", "--provision-vcpu", "--provision-memory-gib", "--provision-disk-gib", "--provision-guaranteed-mbps", "--provision-burst-mbps"].includes(token)) {
       const value = Number(argv2[++index] ?? "");
       options.deployInitCustomized = true;
@@ -19985,6 +20026,7 @@ function interactiveGenesisGuests() {
     vcpu: bootstrapNumber(`Guest ${index} vCPUs`),
     memoryGib: bootstrapNumber(`Guest ${index} memory GiB`),
     diskGib: bootstrapNumber(`Guest ${index} disk GiB`),
+    diskEncryption: bootstrapBoolean(`Guest ${index} encrypts its persistent disk with LUKS2?`, "yes") ? "luks2" : "none",
     egressGuaranteedMbps: bootstrapNumber(`Guest ${index} guaranteed egress Mbps`),
     egressBurstMbps: bootstrapNumber(`Guest ${index} burst egress Mbps`),
     confidential: bootstrapBoolean(`Guest ${index} requires confidential SEV-SNP compute?`)
@@ -20977,6 +21019,7 @@ async function cmdDeploy(options, args) {
       initializeTypeScriptDeployment(options.projectRoot, {
         name: options.projectName ?? basename3(resolve13(options.projectRoot)),
         force: options.force,
+        branch: options.branch,
         runtime: options.deployRuntime,
         operatingSystem: options.deployOperatingSystem,
         isolation: options.deployIsolation,
@@ -20997,6 +21040,7 @@ async function cmdDeploy(options, args) {
           options.deployProvisionMemoryGib,
           options.deployProvisionDiskGib,
           options.deployProvisionGuaranteedMbps,
+          options.deployProvisionDiskEncryption,
           options.deployProvisionBurstMbps,
           options.deployProvisionMonthlyAmountCents,
           options.deployMaxMonthlySpendMinor
@@ -21012,6 +21056,7 @@ async function cmdDeploy(options, args) {
               vcpu: options.deployProvisionVcpu ?? 0,
               memoryGib: options.deployProvisionMemoryGib ?? 0,
               diskGib: options.deployProvisionDiskGib ?? 0,
+              diskEncryption: options.deployProvisionDiskEncryption ?? "luks2",
               egressGuaranteedMbps: options.deployProvisionGuaranteedMbps ?? 0,
               egressBurstMbps: options.deployProvisionBurstMbps ?? 0,
               confidential: options.deployIsolation === "sev-snp"
@@ -21359,7 +21404,7 @@ function usage() {
 	 --provision-environment <key> --provision-ownership <platform|tenant-metal>
 	 --provision-metal <host>      Required only for tenant-metal ownership
 	 --provision-physical-cores <n> --provision-vcpu <n>
-	 --provision-memory-gib <n> --provision-disk-gib <n>
+	 --provision-memory-gib <n> --provision-disk-gib <n> --provision-disk-encryption <none|luks2>
 	 --provision-guaranteed-mbps <n> --provision-burst-mbps <n>
 	 --provision-monthly-amount-cents <n> Exact approved USD cost per created compute
 	 --max-monthly-spend-minor <n> Hard approved scale-out spend ceiling

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.134";
+var VERSION = "0.1.136";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -1058,6 +1058,7 @@ async function applyMetalBootstrap(config, options) {
     "qemu-utils",
     "cloud-image-utils",
     "lvm2",
+    "cryptsetup",
     "nftables",
     "curl",
     "ca-certificates"

package/dist/metal-helper-socket.js

@@ -56,6 +56,10 @@ function guestUnit(spec) {
     `ExecStopPost=-/usr/sbin/ip link del ${spec.tap}`
   ].join(`
 `) : "";
+  const encryptedDisk = spec.diskEncryption ? `LoadCredentialEncrypted=${spec.diskEncryption.credentialName}:${spec.diskEncryption.credentialPath}
+ExecStartPre=/usr/sbin/cryptsetup open --type luks2 --key-file %d/${spec.diskEncryption.credentialName} ${spec.diskEncryption.source} ${spec.diskEncryption.mapper}
+ExecStopPost=-/usr/sbin/cryptsetup close ${spec.diskEncryption.mapper}
+` : "";
   return `[Unit]
 Description=ForgeZero guest ${spec.name}
 Documentation=https://www.forgezero.net
@@ -65,7 +69,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 Slice=forgezero-guests.slice
-${tapSetup}
+${encryptedDisk}${tapSetup}
 ExecStart=${argv}
 Restart=always
 RestartSec=5
@@ -754,8 +758,9 @@ function assertSupportedGuestImage(imageKey, confidential = false) {
 }
 
 // src/metal-provision.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 import {
+  chmodSync as chmodSync2,
   existsSync as existsSync2,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync2,
@@ -989,6 +994,8 @@ function guestBootstrapOperations(profile, attested = Boolean(profile.confidenti
   validateMetalProfile(profile);
   const agentBun = "/usr/local/lib/forgezero/bun";
   return [
+    ["/usr/sbin/swapoff", "--all"],
+    ["/usr/bin/systemctl", "mask", "--now", "swap.target"],
     ...attested ? [
       ["/usr/sbin/modprobe", "sev-guest"],
       ["/usr/bin/test", "-c", "/dev/sev-guest"]
@@ -1065,6 +1072,7 @@ ${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
   return {
     userData: `#cloud-config
 package_update: true
+swap: { size: 0 }
 ${users}disable_root: true
 # Git is part of the deployment transport, not a tenant-selected prerequisite:
 # every dynamically claimed repository must be cloneable on a clean image.
@@ -1097,7 +1105,8 @@ var checked = async (exec, argv) => {
 async function provisionMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
   assertSupportedGuestImage(claim.spec.imageKey, claim.spec.confidential);
-  if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
+  const diskEncryption = claim.spec.diskEncryption ?? "none";
+  if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !["none", "luks2"].includes(diskEncryption) || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
     throw new MetalProvisionError("invalid compute claim");
   const image = profile.images[claim.spec.imageKey];
   if (!image || !isAbsolute(image.path) || !SHA256.test(image.sha256)) {
@@ -1126,6 +1135,9 @@ async function provisionMetalGuest(profile, claim, exec) {
   const prior = manifests.find((row) => row.computeKey === claim.computeKey);
   if (prior && prior.reference !== claim.spec.reference)
     throw new MetalProvisionError("compute identity conflicts with host inventory");
+  if (prior && (prior.diskEncryption ?? "none") !== diskEncryption) {
+    throw new MetalProvisionError("an allocated guest disk encryption mode is immutable");
+  }
   const address = requestedAddress(profile, claim, manifests);
   const cpuPool = allocateCpuPool(profile, claim, manifests);
   const manifest = prior ?? {
@@ -1137,6 +1149,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     cpuPoolKey: cpuPool.key,
     allowedCpus: cpuPool.cpus,
     allowedMemoryNodes: cpuPool.memoryNodes,
+    diskEncryption,
     phase: "allocating"
   };
   const save = () => writeFileSync2(manifestPath, `${JSON.stringify(manifest, null, 2)}
@@ -1146,8 +1159,70 @@ async function provisionMetalGuest(profile, claim, exec) {
   const exists = (await exec(["lvs", "--noheadings", lv])).exitCode === 0;
   if (!exists)
     await checked(exec, ["lvcreate", "-y", "-n", name, "-L", `${claim.spec.diskGib}G`, profile.volumeGroup]);
+  const encrypted = diskEncryption === "luks2";
+  const mapper = `fz-${createHash2("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const mappedDisk = `/dev/mapper/${mapper}`;
+  const credentialName = `guest-disk-${createHash2("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
+  const keyPath = `/run/forgezero/${credentialName}.key`;
+  let imageTarget = lv;
+  if (encrypted) {
+    mkdirSync2(dirname2(credentialPath), { recursive: true, mode: 448 });
+    mkdirSync2(dirname2(keyPath), { recursive: true, mode: 448 });
+    if (existsSync2(keyPath))
+      unlinkSync2(keyPath);
+    if (!existsSync2(credentialPath)) {
+      if (exists && (await exec(["cryptsetup", "isLuks", lv])).exitCode === 0) {
+        throw new MetalProvisionError("encrypted guest disk exists without its sealed unlock credential");
+      }
+      writeFileSync2(keyPath, randomBytes(64), { mode: 384, flag: "wx" });
+      try {
+        await checked(exec, ["systemd-creds", "encrypt", `--name=${credentialName}`, keyPath, credentialPath]);
+        chmodSync2(credentialPath, 384);
+      } catch (cause) {
+        if (existsSync2(credentialPath))
+          unlinkSync2(credentialPath);
+        throw cause;
+      }
+    } else {
+      await checked(exec, ["systemd-creds", "decrypt", `--name=${credentialName}`, credentialPath, keyPath]);
+    }
+    try {
+      if ((await exec(["cryptsetup", "isLuks", lv])).exitCode !== 0) {
+        await checked(exec, [
+          "cryptsetup",
+          "luksFormat",
+          "--batch-mode",
+          "--type",
+          "luks2",
+          "--cipher",
+          "aes-xts-plain64",
+          "--key-size",
+          "512",
+          "--key-file",
+          keyPath,
+          lv
+        ]);
+      }
+      if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
+        await checked(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+      }
+      imageTarget = mappedDisk;
+      if (manifest.phase === "allocating") {
+        await checked(exec, ["qemu-img", "convert", "-O", "raw", image.path, imageTarget]);
+        manifest.phase = "image-ready";
+        save();
+      }
+    } finally {
+      if (existsSync2(keyPath))
+        unlinkSync2(keyPath);
+      if ((await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+        await checked(exec, ["cryptsetup", "close", mapper]);
+      }
+    }
+  }
   if (manifest.phase === "allocating") {
-    await checked(exec, ["qemu-img", "convert", "-O", "raw", image.path, lv]);
+    await checked(exec, ["qemu-img", "convert", "-O", "raw", image.path, imageTarget]);
     manifest.phase = "image-ready";
     save();
   }
@@ -1171,7 +1246,8 @@ async function provisionMetalGuest(profile, claim, exec) {
     memoryGib: claim.spec.memoryGib,
     allowedCpus: manifest.allowedCpus,
     allowedMemoryNodes: manifest.allowedMemoryNodes,
-    disk: lv,
+    disk: encrypted ? mappedDisk : lv,
+    ...encrypted ? { diskEncryption: { source: lv, mapper, credentialName, credentialPath } } : {},
     seed,
     bridge: profile.bridge,
     mac: manifest.mac,
@@ -1229,6 +1305,7 @@ function legacyPlatformManifest(profile, claim, name) {
     cpuPoolKey: claim.spec.cpuPoolKey ?? "",
     allowedCpus: values.get("CPUSET") ?? "",
     allowedMemoryNodes: values.get("NUMA"),
+    diskEncryption: "none",
     phase: "running",
     disk,
     unit: `forgezero-guest@${name}.service`
@@ -1243,6 +1320,9 @@ async function removeMetalGuest(profile, claim, exec) {
   const service = `forgezero-guest@${name}.service`;
   const unitPath = join2(profile.unitDir, service);
   const lv = `/dev/${profile.volumeGroup}/${name}`;
+  const mapper = `fz-${createHash2("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialName = `guest-disk-${createHash2("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const manifest = existsSync2(manifestPath) ? JSON.parse(readFileSync2(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
   if (!manifest) {
     const seedBase = join2(profile.seedDir, name);
@@ -1277,9 +1357,14 @@ async function removeMetalGuest(profile, claim, exec) {
   else if ((await exec(["systemctl", "is-active", service])).exitCode === 0) {
     throw new MetalProvisionError("guest unit is active but its owned unit file is missing");
   }
+  const encrypted = (manifest.diskEncryption ?? "none") === "luks2";
+  if (encrypted && (await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+    throw new MetalProvisionError("guest disk mapping remained active after the guest stopped");
+  }
   if ((await exec(["lvs", "--noheadings", lv])).exitCode === 0)
     await checked(exec, ["lvremove", "-fy", lv]);
   for (const path2 of [
+    ...encrypted ? [credentialPath] : [],
     unitPath,
     join2(profile.seedDir, `${name}-seed.iso`),
     join2(profile.seedDir, `${name}-user-data`),
@@ -1302,7 +1387,7 @@ async function removeMetalGuest(profile, claim, exec) {
 }
 
 // src/metal-helper-socket.ts
-import { chmodSync as chmodSync2, existsSync as existsSync3, unlinkSync as unlinkSync3 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync3, unlinkSync as unlinkSync3 } from "node:fs";
 import { connect, createServer } from "node:net";
 var DEFAULT_METAL_HELPER_SOCKET = "/run/forgezero-metal/helper.sock";
 var MAX_REQUEST_BYTES = 32 * 1024;
@@ -1382,7 +1467,7 @@ function startMetalHelper(options) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync2(socketPath, 432));
+  server.listen(socketPath, () => chmodSync3(socketPath, 432));
   return {
     server,
     async stop() {

package/dist/metal-provision.d.ts

@@ -63,6 +63,7 @@ export interface GuestManifest {
     cpuPoolKey: string;
     allowedCpus: string;
     allowedMemoryNodes?: string;
+    diskEncryption?: 'none' | 'luks2';
     phase: 'allocating' | 'image-ready' | 'running';
 }
 export declare class MetalProvisionError extends Error {