Encrypting your server's disk

You can encrypt a server's disk with LUKS, so that what's on it can't be read without your passphrase: not by us, not from a backup, not from a disk taken away. You install the system yourself with encryption turned on. Then you type the passphrase in the console each time the server starts. We never see or keep it.

This works for servers that are VMs, on plans with rescue.

Before you start

The install erases the server. Copy off anything you want to keep.
Nobody can get your data back without the passphrase. We can't reset it or unlock the disk for you. Keep the passphrase somewhere safe, such as a password manager.
You'll unlock it at every start. After a reboot, a power cut or maintenance on our side, the server waits for the passphrase. It is unreachable until you type it.

Installing with encryption

On the server's Rescue tab, pick an image marked (installer) and choose Boot from it. The server starts from the installer, with its disk attached. Images marked as installers work in the console. Other images may show nothing there.
Open the Console: on the server's page, or in Hatch if you'd rather use SSH.
Follow the installer. For the addresses, use the ones shown on the server's page: its IPv4 and IPv6 addresses, gateways and name servers.
When it asks how to partition the disk, choose encryption. In the Debian and Ubuntu installers, that's Guided - use entire disk and set up encrypted LVM. Set your passphrase there.
When the installer says it's finished, choose End rescue on the Rescue tab. The image is taken out and the server starts from its own disk.

Unlocking at each start

When the server starts, it stops early on with a prompt such as Please unlock disk. Open the console (on the server's page, or the console in Hatch), type the passphrase and press Enter. Nothing shows as you type. The server then carries on starting as usual.

Hatch is handy when the account page isn't: connect with ssh -p 2222 'you@example.com'@HATCH-HOST (your account's email), pick the server, then its console. See Hatch.

If you'd rather unlock over SSH, systems such as Debian and Ubuntu offer a small SSH server that runs before the disk is unlocked (dropbear-initramfs). Set it up inside your server with its own key, and give it your server's address with the kernel's ip= setting.

What changes for a server you installed yourself

The Access tab. It sets passwords, SSH keys and the host name with cloud-init, which our images have. A system you install yourself has it only if you install it (the cloud-init package). Otherwise, manage access inside the server.
Snapshots and backups still work. What they hold is encrypted, so a restored server asks for the same passphrase.
Reinstall erases the encrypted disk and puts one of our images back, unencrypted.
Usage graphs and power controls work as before.