There are several methods available for encrypting server disks without compromising availability but the best I’ve used is Network Bound Disk Encryption in the form of tang and clevis utilities. The encrypted server consults a tang server (or multiple servers using Shamir’s Secret Sharing) for the decryption key and then boots without user intervention. You can put a range of controls and redundancies around tang servers but the idea is they are only available on the local network.
Before you say there’s no point encrypting a disk and then automatically decrypting it, think about the use case. The encrypted server will auto decrypt if everything is fine, but remain protected if that server is stolen or the decryption servers are shutdown or modified. It provides convenience while maintaining a level of protection. It also ensures disks are preemptively encrypted if they ever need to be returned for a warranty claim, which is a much more likely event.
There are several methods available for encrypting server disks without compromising availability but the best I’ve used is Network Bound Disk Encryption in the form of tang and clevis utilities. The encrypted server consults a tang server (or multiple servers using Shamir’s Secret Sharing) for the decryption key and then boots without user intervention. You can put a range of controls and redundancies around tang servers but the idea is they are only available on the local network.
Before you say there’s no point encrypting a disk and then automatically decrypting it, think about the use case. The encrypted server will auto decrypt if everything is fine, but remain protected if that server is stolen or the decryption servers are shutdown or modified. It provides convenience while maintaining a level of protection. It also ensures disks are preemptively encrypted if they ever need to be returned for a warranty claim, which is a much more likely event.