Background: I’d like to turn an old personal laptop into a Jellyfin server so that I can stream media to my living room TV. I want to be able to expand what I use this server for over time. I’m leaning toward Proxmox as the OS so that I can spin up new containers for various services instead of installing a bunch of services on a base Debian install. I also want full disk encryption so that any data on the OS drive is less likely to be compromised by theft or Craigslist.

Question #1: I gather the general accepted approach for this is to first install Debian as a base w/ full disk encryption enabled and then install Proxmox on top because there is no option for full disk encryption in the native installer for Proxmox. Is this still the case?

Excerpt from this tutorial from November 2023 on the Proxmox Forum:

This tutorial deals with encryption of an existing installation. If you are starting fresh, my recommendation would be to install Debian with full disk encryption and then add Proxmox to it.

Excerpt from this post from February 2019 on the Level1Techs Forum:

The easiest way to do an encrypted Proxmox setup is to start with a minimal, vanilla Debian install. Set up the encrypted partition using the installer like you would with any other Debian system. Once installed, reboot. Then follow the guide for installing Proxmox on Debian.

Question #2: I don’t mind entering the key manually whenever I reboot the server, but will I be able to unlock the server remotely? For example, suppose I’m tinkering in the web admin panel or an SSH session and I want/need to reboot—will I have to physically go over to the laptop and enter the key every time?

Also, I appreciate any other tips from the community to help me think about this in the right way. Thanks!

  • tvcvt@lemmy.ml
    English
    9·
    10 days ago

    Another idea for you: if you use ZFS for the install, check Debian directions on OpenZFS or zfsbootmenu and you’ll get directions for an encrypted installation. You’ll be able to specify the path to a key file, which you can keep on a thumb drive. When the machine boots up, it’ll see the thumb drive and decrypt the zpool automatically; yank the thumb drive and it won’t (backup the key of course).

  • monkeyman512@lemmy.worldEnglish
    41·
    10 days ago

    Any reason you need to encrypt the host OS information? I would assume anything interesting would be in the VM and you could probably have the VM encrypt it’s own storage.

  • pineapple@lemmy.mlEnglish
    2·
    8 days ago

    If you want to set-up disk encryption you should probably understand that while the server is booted up as far as I know there will be no disk encryption leaving it completely available for anyone to take data from

    Although most people entering your house would probably unplug the laptop and open it at there own home the data could still be valuable if it stays powered up with battery power.

    • barnaclebill@lemmy.dbzer0.comOPEnglish
      1·
      7 days ago

      Good point, thanks for clarifying that. I suppose the theft scenario is iffy, but it’ll still help in case I ever sell (or junk) the disk.

  • jj4211@lemmy.worldEnglish
    2·
    10 days ago

    You can use one of a few ways to use the TPM to auto decrypt on boot without passphrase. Systemd cryptenroll is my favorite.

  • terminhell@lemmy.dbzer0.comEnglish
    35·
    9 days ago

    I don’t understand why you’d install Debian before the hypervisor.

    Edit: TiL thx for the replies. I legit didn’t know of these scenarios.

    • deafboy@lemmy.worldEnglish
      2·
      9 days ago

      Proxmox is based on Debian, but its installer does not offer you as many options as the base Debian installer. People figured out you can just install debian with your prefered settings and then just slap the proxmox packages on top.

    • jj4211@lemmy.worldEnglish
      2·
      10 days ago

      Because it says to do so?

      Proxmox uses Debian as the OS and for several scenarios it says do Debian to get that done and just add the proxmox software. It’s managing qemu kvm on a deb managed kernel