Disk Encryption

What is encrypted

• Encrypted: the data partition, which holds everything the drone writes after flashing: its settings, its Tailscale identity, flight logs and recordings.
• Not encrypted: the operating system, which is the same on every card, and the small boot partition. For a Wi-Fi drone the boot partition also holds the Wi-Fi password, because the drone has to join the network before it can unlock. Use Ethernet if that password must not leak.

Choose where the key lives

• Your own key server (Tang). Any always-on Debian, Ubuntu or Raspberry Pi OS machine on a network the drone joins at boot. Away from that network the drone stays locked. One-time setup on that machine:

sudo apt-get install -y tang
sudo mkdir -p /etc/systemd/system/tangd.socket.d
printf '[Socket]\nListenStream=\nListenStream=7500\n' | sudo tee /etc/systemd/system/tangd.socket.d/port.conf
sudo systemctl daemon-reload
sudo systemctl enable --now tangd.socket

• Aircast Cloud. No server to run: each card gets its own key in the Aircast Cloud. The trade-off is that the card unlocks anywhere it gets online, until you mark it lost. Needs an Aircast Cloud sign-in in the Flasher.
• Several at once. Add more than one and set Unlock with: 1 of 2 means either server is enough, 2 of 2 means both must answer.

Turn it on

1. In the Flasher's Access step, switch on Disk encryption.
2. Enter your key server, for example http://10.0.0.5:7500, and press Test connection. Use Add a server for more, or turn on Aircast Cloud.
3. Save the recovery key to a file or copy it, then tick I've saved it elsewhere. It is the only way in if no key server answers, and the Flasher keeps no copy.
4. Write the card as usual.

From a terminal, the Flasher's CLI does the same:

aircast-flasher-cli flash --disk /dev/disk4 --hostname falcon-01 \
  --tang http://10.0.0.5:7500 --recovery-file ~/falcon-01-recovery-key.txt

Add --cloud-unlock for Aircast Cloud, and --threshold 2 when both servers must answer.

First boot takes a few minutes and stays offline

On its first boot the drone creates the data partition, encrypts it and prepares the unlock, then restarts once by itself. That takes about 4 minutes on a Raspberry Pi 4 and longer on a Pi Zero 2 W. During that time it does not join Wi-Fi or your tailnet and the dashboard does not open, so a drone that seems missing for the first few minutes is normal. Don't cut the power until it has restarted.

Every boot after that

Before the system starts, the drone connects to the network, asks its key server for the key and unlocks the data partition. With the server reachable this adds a few seconds. At that early point it can use:

• the onboard Ethernet port and USB Ethernet adapters,
• USB 4G sticks running in network (HiLink) mode,
• the Wi-Fi network you set in the Flasher.

4G HATs and modems that need modem setup, such as the Waveshare SIM7600G-H, only come up after the unlock. A drone whose only link is such a modem cannot reach a key server at boot: give it Wi-Fi or Ethernet, or plan to type the recovery key.

When it can't reach a key server

The drone stops before the system starts and shows Please unlock disk data on its HDMI output. It is not on the network and the dashboard does not open.

• It keeps trying. It asks the key server again every few seconds and unlocks by itself as soon as the server answers, provided its network came up. If the network itself was down, fix it and restart the drone.
• Unlock by hand: plug in a USB keyboard, type the recovery key and press Enter. The keyboard of a KVM such as JetKVM works too.

Find out why it didn't unlock

While it waits, the drone writes aircast-boot.log to its boot partition at 15, 30, 60, 120 and 300 seconds, and once more when it unlocks. Put the card in any computer and open it from the bootfs drive. Each entry shows the network interfaces, the address it got, whether Wi-Fi joined, whether each key server answered, and the kernel's Wi-Fi and firmware messages.

With a JetKVM attached and its USB Serial Console turned on, the drone also sends the log through the KVM at each of those points and then every minute, so you can read it without pulling the card. Receive it with the kvm-recv tool in aircast-pi-gen:

JETKVM_URL=http://<jetkvm-address> just kvm-recv --follow

Once a drone is running, kvm-send <file> on it sends any file the same way. A drone in fight mode writes and sends no boot log.

A lost or captured drone

• Aircast Cloud: in the Flasher open Cloud cards and mark the card lost. It never unlocks through the cloud again. This can't be undone.
• Your own key server: the card unlocks wherever it can reach that server, so keep the server on a network the drone only joins at your base.
• Recovery key: it always unlocks the card. Store the recovery files where you would store passwords.