#!/bin/bash
echo not a script
exit 1

# securely(*) wipe disk contents on a running server!
# assumes alpine or another distro which doesn't freak out if the rootfs go poof
#
# alternatively reboot into a rescue-env or livecd, skip to the end of this and
# just run the openssl command in there
#
#  (*): at least on regular HDDs, not so sure about SSDs


# install dependencies
apk add lsof tmux pv
hash -r

# use lsof to list all files which are open for read/write,
# need to kill all related processes/services before remount is possible
mount | grep -E ^/dev/ | awk '{print$3}' | xargs -l lsof | awk 'NR==1 || $4~/[0-9][uw]/'

# usually something like the following
service nginx stop
service syslog stop

# list all active filesystems
df -h | grep -E '^[F/]'

# example output, we care about "Mounted on":
# Filesystem      Size  Used Avail Use% Mounted on
# /dev/sda2       1.8T 1009G  852G  54% /
# /dev/sda1        93M   25M   62M  29% /boot

# now remount all the filesystems as read-only
# (probably pointless but just in case)
mount -o remount,ro /boot
mount -o remount,ro /

# if any of the remounts fail, try the lsof again and stop some more services
# or ignore it and just continue :p

# enter into a tmux/screen session...
tmux -2u

# ...and initiate the disk wipe,
# don't do anything while it runs or you'll probably kernel-panic and interrupt it
#
# note: replace /dev/sda with your HDD
# note: if you have multiple HDDs then leave the rootfs drive for last!

openssl enc -aes-256-ctr -iter 1 -pass pass:"$(
  head -c64 < /dev/urandom | base64 | tr -d '\n'
  )" -nosalt < /dev/zero | pv -i 0.2 > /dev/sda

# if your openssl is old you may have to remove the  -iter 1
