Question: USB fallback on headless tang bound machines

[spacerunner5]

Hi,

please excuse, this is not an issue but rather a question posted here due to the lack of finding the required documentation on the required scenario:

Clevis client bound to a tang server, multiple disks encrypted. Scenario: network failure, no tang server available, forced offline boot etc.

Question: How can I configure a headless machine to auto decrypt (luksopen) on boot using keys stored on a USB key if tang servers are not available anymore?

Is it correct that clevis does not have such a functionality build in currently?

Any help / resources / hints are greatly appreciated.

Thank you :)

Edit: Of course it is assumed that the "rescue key medium" is not permanently attached to the machines.

[cbiedl]

Years ago, I've created a "medium" pin for precisely that purpose: https://github.com/cbiedl/clevis/commit/5ec0fbc8be6bee1e4e7d682b8f12bcea277e3e21 For various reasons I'd really like to see it in clevis.