Instead, the usual approach - the old^Wmature technology - is in use. With the help of netbsd-users maillist (https://mail-index.netbsd.org/netbsd-users/2026/09/21/msg034895.html) I configured the next thing for HDD with RAIDframe, CGD and LVM:
1) Two identical 1TB disks: /dev/wd0 and /dev/wd1.
2) Both in use in RAID1 /dev/raid0 (as described in this document: https://netbsd.org/docs/guide/en/chap-rf.html, but without any tricks for root FS).
3) /dev/raid0 divided in two parts: /dev/raid0a for root FS and /dev/raid0b.
4) Both disks (/dev/wd0 and /dev/wd1) has installed bootloader via /usr/sbin/installboot -o timeout=10 -v /dev/rwd0 /usr/mdec/bootxx_ffsv2 and /usr/sbin/installboot -o timeout=5 -v /dev/rwd1 /usr/mdec/bootxx_ffsv2
5) The /dev/raid0b was encrypted with CGD, so the /dev/raid0b -> /dev/cgd0.
6) The whole encrypted disk (/dev/cgd0a) was added as physical volume to LVM. The volume group /dev/vg0 was created with this PV and the logical volume /dev/vg0/lv0 was created inside this VG to store the real data.
The LVM allows to add new disk space, just by adding new physical volume to the volume group and then extending the logical volume and resizing the FFSv2. I tested it with a test USB drive and it works and even doesn't led to data loss
And the separate CGD separately encrypts existing physical volume and each new physical volume just in case
One quirk: the underlying physical disks (/dev/wd0 and /dev/wd1) plus /dev/raid0 should use MBR partition scheme or NetBSD disklabel - because the root partition should start from 0 sector - if it started not from zero sector, then the bootloader will be unable to find root FS. I tried to use GPT, but the installer was unable to create root partition not from zero sector, only from 2048 sector
#NetBSD #RAIDframe #CGD #LVM #selfhosting