Setting up Encrypted ZFS on NetBSD

I just set up an encrypted ZFS volume on my NetBSD install. This is my journal on how I did it. I’m using a zpool on top of NetBSD’s cgd Cryptographic Disk layer (similar to LUKS on linux), because NetBSD’s ZFS does not have ZFS’s native encryption available. Most of this post is about setting up cgd. So before I get into things: I haven’t yet done an install with a ZFS rootfs. I also haven’t done an install with an encrypted rootfs. I certainly haven’t done both together. It is possible, but we’re not covering it here. I’ll put links in the references at the bottom of the page that may help if you want to give that a go, but it gets more complicated because you need to set up a ramdisk. Also, since it is 2026, I must unfortunately remind you. GPT, in this article, means “GUID Partition Table”, as it has meant since the 90s. Before we get into setting up the disks, here’s something that will make life easier. Add devpubd=YES to your rc.conf, and turn it on with /etc/rc.d/devpubd…