Remote unlock encrypted root filesystems over SSH on boot. Note that most systems do not encrypt /boot and therefore dropbear keys should be considered compromised/untrusted; use separate keys when using dropbear!

See wireguard-initramfs to enable wireguard service on boot for fully encrypted remote boot root FS unlock!

Dropbear Setup

Install dropbear package
apt install dropbear-initramfs

Set dropbear options:

0644 root root /etc/dropbear-initramfs/config
# Configuration options for the dropbear-initramfs boot scripts.
# You must run update-initramfs(8) to effect changes to this file (like
# for other files under the '/etc/dropbear-initramfs' directory).

# Command line options to pass to dropbear(8)
# -s -g - disable user, root password auth
# -j -k - disable local, remote port forwarding
# -m disable MOTD
# -p 22 listen on all interfaces, port 22
# -T 1 one authentication attempt
DROPBEAR_OPTIONS='-s -g -j -k -m -p 22 -T 10'

# On local (non-NFS) mounts, interfaces matching this pattern are
# brought down before exiting the ramdisk to avoid dirty network
# configuration in the normal kernel.
# The special value 'none' keeps all interfaces up and preserves routing
# tables and addresses.

# On local (non-NFS) mounts, the network stack and dropbear are started
# asynchronously at init-premount stage.  This value specifies the
# maximum number of seconds to wait (while the network/dropbear are
# being configured) at init-bottom stage before terminating dropbear and
# bringing the network down.
# If the timeout is too short, and if the boot process is not blocking
# on user input supplied via SSHd (ie no remote unlocking), then the
# initrd might pivot to init(1) too early, thereby causing a race
# condition between network configuration from initramfs vs from the
# normal system.

Dropbear uses a special binary format for host keys. Generate a new pair of host keys to use, and remove all others:

Generate new dropbear host keys (RSA 4096); remove unused.
dropbearkey -t rsa -s 4096 -f /etc/dropbear-initramfs/dropbear_rsa_host_key
rm /etc/dropbear-initramfs/dropbear_{dss,ecdsa,ed25519}_host_key

Create a set of SSH keys to use for dropbear explicitly. These should be password protected. Add to authorized keys for dropbear.

Create SSH keys and set authorized keys for dropbear.
ssh-keygen -b 4096 -t rsa -f ~/.ssh/dropbear
cp ~/.ssh/dropbear.pub /etc/dropbear-initramfs/authorized_keys

Update Kernel

The kernel must be updated everytime the dropbear configuration is changed.

Update Kernel with Dropbear configuration.
update-initramfs -u

Remote Unlock

Use the dropbear key and unlock the system remotely.
ssh -i ~/.ssh/dropbear root@remote_host
# cryptroot-unlock