Encrypted root volume with LUKS
Customer-held passphrase, LUKS2 root encryption and reboot-survival via rescue-ISO unlock on a NoctisNode server.
Full-disk encryption protects data at rest from physical access and disk reuse. On NoctisNode you hold the passphrase — we cannot decrypt your disks and never store keys.
Choose the right moment
Encrypting a live root is possible but fiddly; the clean path is to reinstall with LUKS from the start. Boot the rescue ISO, partition with a small unencrypted /boot and a LUKS2 container for everything else, then debootstrap or restore your image into it.
Core commands
Use argon2id key derivation and a long passphrase. Add /etc/crypttab entries so the initramfs prompts for the passphrase at boot.
cryptsetup luksFormat --type luks2 --pbkdf argon2id /dev/sda2
cryptsetup luksOpen /dev/sda2 root
mkfs.ext4 /dev/mapper/rootSurviving reboots
- ▹With console access over IPMI (dedicated) or VNC (VPS), type the passphrase at boot.
- ▹If you need an unattended reboot, consider a remote-unlock SSH into the initramfs (dropbear) — key-only, bound to the console network.
- ▹Test the reboot path before you rely on it: reboot once in a maintenance window.