disk encryption

[jacksingleton]

There's a neat trick people do where they embed dropbear (a small ssh server) into the ramdisk, which allows you to ssh and enter the luks password while booting the server to achieve full disk encryption on a headless machine.

https://kiza.eu/journal/entry/697

Unfortunately it looks like systemd caused problems with this setup. though there might be a workaround: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618862#158 (the tutorial here is for Jessie, what do they do? https://xn3.wiki/debian/deb_kimsufi_atom_srv_luks)

A less involved option would be to set up a luks encrypted volume just to store sandstorm data on (and maybe encrypted swap as well). Not as good as FDE, but it's still something.