

I rule Clueless Mod as well. To be fair, they’re usually doing a very good job in that community.
I’ve used a Dropbear SSH server in the initramfs for a while to unlock my server:
- https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote_unlocking_of_root_(or_other)_partition
- https://wiki.ubuntuusers.de/Verschlüsseltes_System_via_SSH_freischalten/ (German)
Other possibilities include using the TPM module, a USB flash drive with a keyfile on it… A KVM / remote management module which is part of server and enterprise hardware anyway…
The latter is probably the easiest and most reliable solution.
There’s good use-cases for encryption on servers. Especially if other people have physical access to the location. Or it’s at home and a robber could steal it. Or you’d need a kill-switch to just turn it off and the encryption at rest kicks in… You don’t need to overwrite harddisk several times on replacement, or whip out the power tools to drill holes in it once it’s e-waste. And I have a lot of personal data on my server. Emails, my phone and laptop sync to it so there’s all my private photos, scans of paperwork and half of my life stored on the NAS. So of course I’m going to protect that. And of course it’s related to selfhosting because we have all kinds of sensitive information stored on selfhosted servers.







If you just want something simple that does the job, you can try a turnkey solution like YunoHost. There’s several other ones out there. Some with containers, some with more or less pre-packaged software… If you want to learn more during the process, maybe don’t and do it yourself because these things don’t teach you a lot. There’s some resources like the awesome-selfhosted list in the sidebar of this community. But I think for installing services you’d mainly look at the specific documentation of the specific service you’re just about to tackle. And maybe read up on Docker containers etc to judge whether you want to do it that way.