Replace encrypted boot NVME

[aklj_ekj]

Hi everyone,
I've installed proxmox fully encrypted according to the following tutorial (as far as I remember):

J

[TUTORIAL] Thread 'Adding Full Disk Encryption to Proxmox'

Nov 24, 2023

If you want to encrypt your data, the best way is usually to start at the lowest layer possible to get as much data encrypted as possible. If you run all your VMs on top of Proxmox, then adding encryption to all disks in Proxmox is the natural solution, but there doesn't seem to be an official way. In addition, I haven't found a full guide, but lots of people that wanted to do it and didn't know how. This tutorial is for those people: If you want to add full disk encryption to Proxmox, follow along.

Warning: Here be dragons. This is not officially supported and could break on update...

• Javex
• luks lvm
• Replies: 90
• Forum: Proxmox VE: Installation and configuration

• 

Current Proxmox version:
8.4.14

Dropbear is running to unlock at boot with ssh and zfs shows rpool with two /dev/mapper devices:

NAME             SIZE  ALLOC   FREE  CKPOINT  EXPANDSZ   FRAG    CAP  DEDUP    HEALTH  ALTROOT
rpool            928G   415G   513G        -         -    46%    44%  1.00x    ONLINE  -
  mirror-0       928G   415G   513G        -         -    46%  44.7%      -    ONLINE
    cryptroot1   931G      -      -        -         -      -      -      -    ONLINE
    cryptroot2   931G      -      -        -         -      -      -      -    ONLINE

Now I've noticed that both NVME have a wearout of >91% (spare both at 100%).

How can I replace one of those NVME?
Due to the encryption I don't think it's as easy as ...
- Shutdown
- Replace one NVME
- Boot
- Add / replace disk in zfs pool?

Thanks a lot for your help in advance!