From owner-freebsd-stable@freebsd.org  Sat Apr 17 19:53:02 2021
Return-Path: <owner-freebsd-stable@freebsd.org>
Delivered-To: freebsd-stable@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.nyi.freebsd.org (Postfix) with ESMTP id 8CE395E109E
 for <freebsd-stable@mailman.nyi.freebsd.org>;
 Sat, 17 Apr 2021 19:53:02 +0000 (UTC)
 (envelope-from petefrench@ingresso.co.uk)
Received: from constantine.ingresso.co.uk (constantine.ingresso.co.uk
 [IPv6:2001:470:6a18:411::3])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 4FN3f54Nmvz3HbY
 for <freebsd-stable@freebsd.org>; Sat, 17 Apr 2021 19:53:01 +0000 (UTC)
 (envelope-from petefrench@ingresso.co.uk)
Received: from [2001:470:6cc4:1:b8fa:e0b2:3edf:f1ec]
 (helo=balta.drayhouse.twisted.org.uk)
 by constantine.ingresso.co.uk with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256
 (Exim 4.94 (FreeBSD)) (envelope-from <petefrench@ingresso.co.uk>)
 id 1lXqzu-000NGS-27
 for freebsd-stable@freebsd.org; Sat, 17 Apr 2021 19:52:54 +0000
To: FreeBSD Stable Mailing List <freebsd-stable@freebsd.org>
From: Pete French <petefrench@ingresso.co.uk>
Subject: geli - is it better to partition then encrypt, or vice versa ?
Message-ID: <c2905507-ea7b-a0ba-a167-8835f600f040@ingresso.co.uk>
Date: Sat, 17 Apr 2021 20:52:53 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0)
 Gecko/20100101 Thunderbird/78.9.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
X-Rspamd-Queue-Id: 4FN3f54Nmvz3HbY
X-Spamd-Bar: /
Authentication-Results: mx1.freebsd.org; dkim=none;
 dmarc=pass (policy=none) header.from=ingresso.co.uk;
 spf=pass (mx1.freebsd.org: domain of petefrench@ingresso.co.uk designates
 2001:470:6a18:411::3 as permitted sender)
 smtp.mailfrom=petefrench@ingresso.co.uk
X-Spamd-Result: default: False [-0.80 / 15.00]; RCVD_TLS_ALL(0.00)[];
 RCVD_VIA_SMTP_AUTH(0.00)[]; MID_RHS_MATCH_FROM(0.00)[];
 FROM_HAS_DN(0.00)[];
 RBL_DBL_DONT_QUERY_IPS(0.00)[2001:470:6a18:411::3:from];
 TO_MATCH_ENVRCPT_ALL(0.00)[];
 R_SPF_ALLOW(-0.20)[+ip6:2001:470:6a18:411::3];
 MIME_GOOD(-0.10)[text/plain]; ARC_NA(0.00)[];
 NEURAL_SPAM_MEDIUM(1.00)[1.000]; RCPT_COUNT_ONE(0.00)[1];
 SPAMHAUS_ZRD(0.00)[2001:470:6a18:411::3:from:127.0.2.255];
 TO_DN_ALL(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000];
 DMARC_POLICY_ALLOW(-0.50)[ingresso.co.uk,none];
 NEURAL_HAM_SHORT(-1.00)[-0.998]; FROM_EQ_ENVFROM(0.00)[];
 R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+];
 ASN(0.00)[asn:6939, ipnet:2001:470::/32, country:US];
 SUBJECT_ENDS_QUESTION(1.00)[];
 MAILMAN_DEST(0.00)[freebsd-stable]; RCVD_COUNT_TWO(0.00)[2]
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-stable>, 
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 17 Apr 2021 19:53:02 -0000

So, am building a zpool on some encrypted discs - and what I have done 
is to partition the disc with GPT add a single big partition, and 
encrypt that. So the pool is on nda1p1.eli.

But I could, of course, encrypt the disc first, and then partition the 
encrypted disc, or indded just put the zpool directly onto it.

Just wondering what the general consensus is as to the best way to go 
here ... if there is one! :-) What do other people do ?

-pete.