onionvps

Guide

Full-disk encryption on a VPS with remote unlock

Advanced30 min readUpdated June 11, 2026
Short answer

LUKS2 with a dropbear SSH daemon in the initramfs lets you encrypt the root filesystem and supply the passphrase remotely at every boot. The provider never holds the key, so a powered-off disk is ciphertext. It does not protect against a compromised hypervisor, and no provider can honestly claim otherwise.

01 Understand exactly what this protects

Protects against: physical seizure of a powered-off disk, decommissioned hardware, a datacentre incident, a technician with physical access. Does not protect against: a compromised running hypervisor, or a compromise of the running instance. The key is in memory while the machine runs.

02 Install to an encrypted root

On the Bastion line this is preconfigured. On any other instance, boot the distribution installer through the out-of-band console and choose an encrypted LVM layout.

03 Add dropbear to the initramfs

This is what lets you supply the passphrase over SSH before the root filesystem is mounted.

apt install -y dropbear-initramfs cryptsetup-initramfs
echo 'DROPBEAR_OPTIONS="-p 2222 -s -j -k"' >> /etc/dropbear/initramfs/dropbear.conf
cat ~/.ssh/id_ed25519.pub > /etc/dropbear/initramfs/authorized_keys
update-initramfs -u -k all

04 Configure the boot network

The initramfs has no DHCP client by default; give it a static configuration matching your instance.

# /etc/initramfs-tools/initramfs.conf
IP=203.0.113.10::203.0.113.1:255.255.255.0::eth0:off

05 Unlock after each reboot

Connect on the initramfs port and supply the passphrase. The boot then continues normally.

ssh -p 2222 [email protected]
# then: cryptroot-unlock

Frequently asked questions

What happens if the server reboots while I am asleep?

It waits at the unlock prompt. That is the trade: unattended reboots are impossible, which is exactly what makes the key genuinely yours.

Can OnionVPS unlock my disk?

No. We never hold the passphrase, and there is no recovery mechanism. If you lose it, the data is gone.