Encrypt backup to external USB drive in OS6.10.2

[the1within0]

TL;DR - Why does the sqlite3 database revert after my udev rule script ends?

Similar to @Labdoc1 here, I'm trying to get an encrypted external USB drive to auto mount and dismount using the Web interface. Here's what I've learned so far:

1. The /var/readynasd/db.sq3 sqlite3 database needs to be updated in two tables for a drive to show up in the web UI.
   1. Add a record to usb_storage table. This is partially done for you, but some of the fields are blank (like fstype) becuase it doesn't understand how to interpret crypto_LUKS
   2. Add a record to the share table
   3. (Optional) Add a record to the zfs_attrs table
   4. WARNING: These tables may all be very specific to 6.10.2, and may not be forward compatible. I just don't know enough about it.
2. The /etc/frontview/usb/usb_map file needs to be updated/used
   1. If there is an entry for the uid, use that name, else add an entry
3. Use cryptsetup to create decrypted device in /dev/mapper
4. Mount decrypted device in /media/{name} using the name in usb_map

At this point, the device will show up in the web UI, but will NOT show up on the "System" tab, only the "Share" tab. More importantly, it can be selected on the backup tab, so it's good to go for backups.

To make this all trigger automatically, I chose to write some udev rules to accomplish this. The script I have works perfectly when called manually (via ssh session). It's only during udev I have more issues. Here are the problems I encountred:

1. udevd runs in an isolated mount namespace. This means when you mount something in a script called by udev, you do not see the mount from the rest of the OS (principal namespace). The solution to this was to disable the mount isolation. (However, I do not understand the security implications of this.)
2. udev rules are auto killed after about 5 seconds. So I "detach" them into the background to get around that.
3. While my script can successfully use the sqlite3 cli to both add the database entries and verify they are there, the instant my backgrounded script ends, the database instantly reverts. This is the part I cannot comprehend.

I've tried a number of things:

1. Making sure my rule runs first (98)
2. Making sure my rule runs last (99-z)
3. Adding a 10 second delay, thinking it was a timing issue
4. Adding a 10 second delay, then adding a loop that for another 10 seconds at the end, would print out the share/usb_storage tables every 1 second.
   1. During those 10 seconds, I could run an sql SELECT in both the udev scrip logs and a normal ssh session, and see that the entries are indeed updated with my values, for all 10 seconds.
   2. Then the instant the script (that was background in udev) ends, the database reverts. I am using multiple calls to the sqlite3 cli, so I am not keeping a "connection open" to the database. Furthermore I added a .timeout 10000 (init script) so that I don't fail when two processes happen to try and lock the database at the same time.

What mechanism is possibly causing the database to revert like this when my bash script ends? And how can I get around this?

Effort stored here (but not really ready for public consumption, especially since it doesn't work yet)

[the1within0]

After a lot more digging, I've figured out the problem.

1. I have to edit the database after ReadyNAS has added the initial entry. So it was a timing issue.
2. I was unable to wait until after ReadyNAS because udev uses cgroups, and tracks all forks and children, disowned or not, and all of udev waits until my scripts finish, so ReadyNAS always comes afterwards.
3. Using udev for a long running script (more than a few seconds) is the wrong thing to do. The solution is to use systemd and run a separate service

Now the solution is to:

1. udev rule that kicks off a systemd service when it sees an encrypted usb disk
2. serivice that execs and runs the script
3. Script that looks for encryption key, decrypts volume, mounts volume, and then updates the database

Now I have a working auto decrypt usb on insert, with the ability to unmount from the web interface!

General warning to anyone who uses this. It may be speicific to my version of ReadyNAS, and may not work on your system. I offer no warrenty that this won't break things in the worst case. Be careful if you try this, you've been warned. I tried my best to make robust.

Solution can be found here.