I worked this out a few days back, maybe a week now, and I currently have it set up so that my laptop, with its convenient power loss protection (and with the nonsense going on downstairs with renovations, it has been very handy) to operate as a secured (physically) backup server. I can shut down my main workstation, and I know that even if someone physically gets control of my laptop, they have to first break my password security, and I have a script to kill it as well, destroying any ability to do this.

So this article I am going to publish the simple scripts I use to unlock and shut down my secure data storage server.

first, a script that lets me get shell on my server. It's very simple:

    #!/bin/bash
    sshpass -p 'PASSWORD' ssh root@serveradddress

Just to clarify, you can't get at the physical storage where my scripts live without unlocking my encrypted home folder. The system boots and demands this password. You can fail to unlock it, but then you have no way to get at it anyway. 

     #!/bin/bash
     sshpass -p 'PASSWORD' ssh root@serveraddress "halt -p"


This script kills my server instantly. If I had DynDNS running to link to it, this could probably be launched with a few taps from an encrypted android phone. It goes down in seconds, because no apps automatically launch, only GDM3 so when I want to physically access the server, I can jump into it, if I have unlocked the home partition from my main workstation, or indeed it is not so hard to manually unlock it, since I know the password.

    #!/bin/bash
    sshpass -p 'PASSWORD' ssh root@serveraddress "$1"

This one lets me execute any arbitrary command at all on the secure storage server. The command can be given by 

    COMMANDNAME "PARAMETERS"

This is to cover the cases when I want to do something arbitrary. Like for example "shred /dev/sda" which would utterly wipe the entire system's hard drive without any possibility of data recovery.

    #!/bin/bash
    sshpass -p 'PASSWORD' ssh root@serveraddress 'bash -s' </home/l0k1/.local/bin/unlockhome.sh

This one is the script that I set up that automatically unlocks the home filesystem, and in my case, automatically bind-mounts the /var/cache/apt/archives that I use to share the .deb archives between both of my machines. I am not going to show you what that script is, but this is an example of running an arbitrary script within another script.

## Finally

The last script I am going to share is one that I use to sync my home folder to the unlocked encrypted storage in the previous entry.

    #!/bin/bash
    sshpass -p 'PASSWORD' rsync -uav --progress /home/l0k1 root@servername:/home/

This one uses rsync to do a synchronisation, pushing all updates onto the secure server store. This does not handle the cleanup of updated, but deleted files. The destination storage device just accumulates changes, anything removed on the workstation, remains on the data storage server. It would be nicer to have a git or other CVS repo to allow me to track back and forward, but this is expedient and I keep pretty close attention on what my workstation has on it. 

I hope this helps someone, better, many people, in how to operate a secure data store for their work.