Compatibility check: Proxmox VE 9.1 (Debian 13 Trixie) + ZFS Mirror + Dropbear

[fajremvp]

Hello everyone, and thanks for this incredible guide.

I am planning a new homelab build and I would like to confirm if this procedure is still valid for the latest Proxmox VE 9.1 (based on Debian 13 "Trixie").

My Scenario:

• OS: Proxmox VE 9.1 (Clean Install via Official ISO).
• Storage: 2x NVMe SSDs configured as ZFS Mirror (RAID 1) during installation.
• Goal: Full Disk Encryption (FDE) using LUKS2, converting the ZFS partitions post-install as per this guide.
• Requirement: I need to unlock the system remotely using Dropbear (SSH in initramfs).

Questions:

1. Are there any known breaking changes regarding initramfs-tools, cryptsetup, or ZFS hooks in Debian 13 that would prevent this method (offline partition -> luksFormat -> zpool replace) from working?
2. Does the Dropbear configuration (/etc/dropbear/initramfs/authorized_keys) work as expected in this version for the remote unlock process?

I want to maintain the "pure" Proxmox structure as much as possible, so this guide seems perfect compared to a manual Debian Netinst + LVM setup.

Thanks in advance!

[mr-manuel]

I did one install with Proxmox 9.1 a few days ago. There are no issues as I'm aware of. Since you are running a fresh build, just go for it 😄

[fajremvp]

Thanks so much!
Since I'm building this from scratch, I just have two quick questions about your experience with this setup:
Have you noticed any significant overhead/latency by wrapping ZFS inside LUKS, especially on NVMe drives? Or does AES-NI handle it well enough that it's negligible for a homelab?
Why LUKS over ZFS Native Encryption? I'm curious about your reasoning for choosing this method (LUKS container) instead of the built-in ZFS Native Encryption. Was it mainly to hide metadata (dataset names/sizes) for full privacy?
Thanks again for maintaining this guide!

[mr-manuel]

It depends on your CPU capabilities. See the first steps here: https://github.com/mr-manuel/proxmox/blob/main/luks-encryption-manual-tpm-ssh-unlock/README.md#install-requirements

I'm using Samsung 990 Pro NVMe drives in Minisforum UM690 Pro devices with an AMD Ryzen 9 6900HX CPU. I noted no significant difference, since the system is still fast enough. If you check the measurings, then you will see a big difference. The NVMe would be capable of 7.000 MB/s, but with LUKS2 it's limited to 3.000 MB/s.

If I remember correctly, one issue with native ZFS encryption was that Proxmox VE replication and migration would not work anymore as also some other Proxmox VE features. With LUKS the encryption is seamless for Proxmox VE.

[fajremvp]

Thanks so much friend! Your manuals were very good for me 😁👍👍👍🥳

[mr-manuel]

You're welcome 😄 if you want, you can find a donation link in my profile. Just in case you want to buy me a beer