wtf is luks-deadman?

luks-deadman is a toolkit for adding physical and logical tamper protection to a Linux server that uses LUKS disk encryption. It is aimed at people who need a server to destroy its own encryption keys automatically if the machine is tampered with or if the person responsible for it goes silent for too long, rather than relying on someone remembering to react to a break in attempt. The toolkit is made of several small pieces that work together. A USB kill switch script watches for a specific USB key to stay plugged into the machine, as long as it is present, the system is considered armed and safe, but if it gets removed, the script wipes the LUKS encryption keys and reboots the server. A separate dead man's switch script expects the operator to send a heartbeat signal at least once every set period, twenty four hours by default. If that heartbeat does not arrive, it sends a warning through a Discord webhook and waits a grace period, one hour by default, before wiping the keys and rebooting if there is still no response. Two small Flask web servers support this system. One exposes simple endpoints so a script or person can send that heartbeat signal and check when the last one was received. The other provides a web page protected by a secret token that lets someone manually trigger the key wipe on demand if needed. A fourth Flask server works alongside a separate program called USBGuard, giving the operator a web interface to review and approve any USB device that gets blocked by default, again behind a token. A setup script installs all of these pieces as background services that start automatically and run with full administrator privileges, since wiping disk encryption keys requires that level of access. The README is direct about the risks involved: these services should only ever be reachable over a private network like Tailscale or a VPN, every default token needs to be replaced before use, and anyone setting this up must double check which disk volume they are pointing the wipe commands at, since the wipe itself cannot be undone once it runs.