Encrypted VPS: Full-Disk Encryption on a Root Server

What full-disk encryption protects on a VPS, its limits versus a dedicated box, and a practical LUKS setup path you control with your own keys.

Полный текст статьи на английском. Шапка, каталог и оплата переведены.

What FDE buys you

Full-disk encryption (LUKS) protects data at rest: disks pulled from a decommissioned host, snapshots lying in cold storage, or a provider-side rescue mount. On a running VPS the kernel holds the keys in memory — the admin of the running host is out of scope; everything else is in scope.

The VPS caveat, stated honestly

On a KVM VPS the decryption key enters the VM at boot. Two practical patterns keep that safe in a no-KYC context: (1) store only encrypted containers/volumes inside the VPS (LUKS on a loop file, cryptsetup on a second disk) opened after boot with your key over SSH; (2) use dedicated servers where you control the boot chain and can hold the key in initrd you own. Pattern (1) is the common middle ground: reboot needs your key — nobody can casually mount your data.

Setup path (LUKS container pattern)

1. Provision a plain VPS, then cryptsetup luksFormat a volume or a loop file.
2. Open it with your passphrase, format the filesystem inside, mount and move the sensitive data in.
3. Add keyscript/systemd units or open it manually after each reboot over SSH.
4. Keep a tested backup of the LUKS header — a lost header is a lost volume.