Encrypted VPS: Full-Disk Encryption on a Root Server

LUKS guards data at rest; a running VPS still holds keys in RAM. Where the protection stops, and the container pattern that works on KVM.

Le corps de l'article est en anglais. L'interface, le catalogue et la caisse sont traduits.

What FDE buys you

Full-disk encryption with LUKS protects the states you are not watching: a disk pulled from a decommissioned host, a snapshot parked in cold storage, a rescue mount performed without you. In those states the data is ciphertext and useless without your passphrase. On a running machine the picture changes — the kernel keeps the keys in memory and the volume is plaintext to root. So the honest boundary is: the running host's administrator is out of scope, and nearly everything else is in scope.

The VPS caveat, stated honestly

A KVM VPS receives its decryption key over the wire at boot, which means the platform side of the boot is a place your key exists. Two patterns work around that in a no-KYC context. Pattern one, the common middle ground: keep only encrypted volumes inside the machine — LUKS on a loop file or on a secondary disk — and open them over SSH after each boot with a key only you hold. A reboot then waits for you, and nobody mounts your data by casually attaching the disk. Pattern two is metal: on a dedicated server you control the boot chain end to end and can carry the key in an initrd you own, with IPMI as the console of last resort.

Setup path (LUKS container pattern)

1. Provision a plain VPS, then cryptsetup luksFormat a volume or a loop file sized for the sensitive set.
2. Open it with your passphrase, build the filesystem inside, and move the data in — keys, mail spools, databases, configuration secrets.
3. Wire a keyscript or systemd unit so reboots wait for input, or open it manually over SSH each time.
4. Back up the LUKS header to a place you control and test that restore; a header lost without backup means a volume lost with it.