# Can I encrypt a VPS disk with LUKS? > Yes: LUKS2 encrypts a volume on a VPS, but the host can see RAM. Gloam, 2 vCPU and 4 GB, costs $8.25 a month on 12 months. - URL: https://gloamport.com/guides/how-to-encrypt-a-vps-disk-with-luks/ - Last updated: 2026-11-10 - Publisher: Gloamport (https://gloamport.com) LUKS protects data at rest. It does not hide a running VPS from the machine it runs on, and this page says where the line is. **Quick answer — Can I encrypt a VPS disk with LUKS?** Yes, you can encrypt a VPS disk with LUKS, because Gloamport gives you full KVM virtualization with your own kernel. Create a volume with cryptsetup luksFormat, open it, format and mount it. A Gloam plan, 2 vCPU, 4 GB RAM, 80 GB NVMe, 4 TB traffic, costs $8.25 a month on 12 months. ## What does LUKS protect on a VPS, and what does it not? | Situation | Protected by LUKS? | Why | | --- | --- | --- | | A copy of the disk image or a snapshot | Yes | The data on disk is ciphertext without the passphrase | | A VPS that is powered off | Yes | The key is not in memory | | A VPS running with the volume open | No | The key and the plaintext sit in RAM, which the host machine can read | | Someone with root inside your VPS | No | They see the mounted volume | | A lost passphrase or a damaged header | No | Data is lost unless you made a header backup | The RAM limit is a property of virtualization, not of Gloamport: any host can read the memory of the guests it runs. ## What does encrypting a VPS disk with LUKS really give you? LUKS gives you encryption at rest: anyone who copies the disk without the passphrase gets noise. It does not give you protection from the host while the VPS runs, because the unlocked key lives in memory that the hypervisor can read. This is why the honest framing matters. Gloamport states that Full KVM virtualization: your own kernel, your own firewall rules and your own disk encryption if you set it up, which makes LUKS possible, and that No plan includes backups: keep your own copy of anything you cannot lose. Pair encryption with your own backups. For the wider question of what a private VPS is and is not, see [What makes a VPS privacy-focused?](https://gloamport.com/privacy-focused-vps/ "What makes a VPS privacy-focused?"). ## Which Gloamport plan suits an encrypted volume? Gloam is a comfortable size: it has 2 vCPU, 4 GB of RAM and 80 GB NVMe of storage, and Gloamport lists it for "A Matrix server, Vaultwarden and SearXNG together". Encryption costs some CPU, so a second core helps. According to Gloamport's survey of 10 November 2026, the median price of a comparable 2 vCPU, 4 GB VPS across 29 hosts was $31.29 a month. Gloam is $8.25 a month on 12 months and $16.50 on 1 month. ## How do I encrypt a volume on a VPS with LUKS, step by step? Seven steps for a data volume held in a file. The same commands work on a block device. 1. **Install cryptsetup** — Run apt install cryptsetup as root. 2. **Create the container file** — Allocate a file of the size you need. cryptsetup maps a regular file to a loop device by itself. 3. **Format it as LUKS2** — Run cryptsetup --type luks2 luksFormat on the file and choose a long passphrase. This wipes anything in the file. 4. **Back up the header** — Run luksHeaderBackup and store the file away from the VPS. A damaged header loses everything otherwise. 5. **Open the volume** — Run cryptsetup open with a mapping name. A device appears under /dev/mapper/. 6. **Make a filesystem and mount it** — Run mkfs.ext4 on the mapped device, create a folder and mount it. 7. **Close it when you are done** — Unmount, then cryptsetup close, which removes the mapping and wipes the key from kernel memory. ## What are the exact LUKS commands? The commands below follow the cryptsetup manual. `luksFormat` initialises the volume and sets the first passphrase, `open` creates the mapping, `luksDump` prints the header, and `luksHeaderBackup` stores a binary backup of the header and key slot area. The manual says that if the header of a LUKS volume is damaged, all data is permanently lost unless you have a header backup. *Create and format the container* ```bash apt install cryptsetup fallocate -l 10G /root/vault.img cryptsetup --type luks2 luksFormat /root/vault.img cryptsetup luksHeaderBackup /root/vault.img --header-backup-file /root/vault.header ``` *Open, format and mount* ```bash cryptsetup open /root/vault.img vault mkfs.ext4 /dev/mapper/vault mkdir -p /mnt/vault mount /dev/mapper/vault /mnt/vault ``` *Close it* ```bash umount /mnt/vault cryptsetup close vault ``` ## Can I unlock an encrypted root disk remotely with dropbear-initramfs? Yes, if the system boots from an encrypted root, a small SSH server in the initramfs can take the passphrase before the root filesystem is mounted. This needs an install you set up with an encrypted root, which is a bigger job than the data volume above, so treat it as an advanced step and check that your image and boot process allow it. The Debian package `dropbear-initramfs` provides SSH access inside the initial RAM filesystem, for instance to unlock encrypted disks. Its documentation places your public keys in `/etc/dropbear/initramfs/authorized_keys` and options in `/etc/dropbear/initramfs/dropbear.conf`, and says to run `update-initramfs -u -k all` after changing them. It also advises not to reuse the main SSH host keys, because `/boot` is usually unencrypted. *Install and apply the initramfs SSH server* ```bash apt install dropbear-initramfs nano /etc/dropbear/initramfs/authorized_keys update-initramfs -u -k all ``` *Optional: listen on another port (dropbear.conf)* ```text DROPBEAR_OPTIONS="-p 2222" ``` > **Test before you rely on it** Keep a second way in and test the unlock on a spare VPS first. A wrong initramfs or a lost passphrase can leave the machine waiting at boot. Use a different SSH port or known-hosts file for the unlock step, since its host keys differ from the main server's. ## How do I keep an encrypted VPS usable over time? Back up the header, write the passphrase down offline, and keep your own copy of the data, since the plan has no backups. The cryptsetup manual says that backup is mandatory for encrypted data as well, if the data has any worth. Lock the front door too. [How do I harden SSH on a new VPS?](https://gloamport.com/guides/how-to-harden-ssh-on-a-vps/ "How do I harden SSH on a new VPS?") covers it, and [How do I generate an SSH key for my VPS?](https://gloamport.com/guides/how-to-generate-an-ssh-key/ "How do I generate an SSH key for my VPS?") covers the key. Plans and terms are on [the pricing page](https://gloamport.com/pricing/ "How much does a Gloamport VPS cost?"). **In summary** - LUKS2 encrypts data at rest on a VPS with full KVM virtualization. - It does not hide a running VPS from the host, which can read RAM. - `cryptsetup --type luks2 luksFormat` creates the volume; `open` and `close` manage it. - Back up the header with `luksHeaderBackup`: a damaged header loses all data. - `dropbear-initramfs` allows remote unlocking of an encrypted root. - Gloam (2 vCPU, 4 GB RAM, 80 GB NVMe, 4 TB traffic) costs $8.25 a month on 12 months. ## LUKS on a VPS: common questions ### Can the VPS host read my LUKS-encrypted data? Not from the disk, but yes while the volume is open, because the key and the data sit in memory the host can read. LUKS protects data at rest. ### Can I use a file instead of a partition? Yes. The cryptsetup manual says that if the device argument is a file, cryptsetup tries to allocate a loopback device and map it to that file. ### What happens if I forget the passphrase? The data cannot be read. Keep the passphrase safe and make a header backup, because a damaged header also loses everything. ### What does dropbear-initramfs do? It starts a small SSH server inside the initial RAM filesystem so you can unlock an encrypted root disk at boot from another machine. ### Does Gloamport include backups? No plan includes backups, so keep your own copy of anything you cannot lose. ## Sources 1. [cryptsetup(8) manual page](https://manpages.debian.org/trixie/cryptsetup-bin/cryptsetup.8.en.html) — Debian (checked 2026-11-10) 2. [cryptsetup-luksFormat(8) manual page](https://manpages.debian.org/trixie/cryptsetup-bin/cryptsetup-luksFormat.8.en.html) — Debian (checked 2026-11-10) 3. [dropbear-initramfs README](https://salsa.debian.org/debian/dropbear/-/raw/debian/latest/debian/README.initramfs) — Debian (checked 2026-11-10) 4. [dropbear-initramfs package (trixie)](https://packages.debian.org/trixie/dropbear-initramfs) — Debian (checked 2026-11-10) --- Gloamport: Gloamport is a VPS provider that sells Linux KVM servers with no KYC, ordered with an account number and paid in crypto, Monero first; it is operated by DomaineGoat LLC, a Panama-registered company. An order asks for a plan, a coin and, only if you want one, an email address: no name, no postal address, no phone and no identity document. On the 12-month term, each plan is priced at least 25% under a named comparable plan from a survey of 38 no-KYC crypto VPS hosts read on 10 November 2026.