Selfhosted

This shouldn't even be a question lol. Even if you aren't worried about theft, encryption has a nice bonus: you don't have to worry about secure erasing your drives when you want to get rid of them. I mean, sure it's not that big of a deal to wipe a drive, but sometimes you're unable to do so - for instance, the drive could fail and you may not be able to do the wipe. So you end up getting rid of the drive as-is, but an opportunist could get a hold of that drive and attempt to repair it and recover your data. Or maybe the drive fails, but it's still under warranty and you want to RMA it - with encryption on, you don't have to worry about some random accessing your data.

Yes of course, with dm-crypt (luks), very little as AES-NI is incredibly fast.

Nope. This isn't part of my threat model.

I don't have sensitive data and stealing a drive would be inconvenient for a thief.

No,

There is all the backup of all my family pictures in the drives.

If something happens to me I want to make due that they will have access to it.

I keep my drives encrypted with a key currently hosted in my router hoping they wouldn’t steal that. I’m thinking of actually putting it to cloud so I can disable it remotely.

It was quite a ride to make everything work and I made a blog post explaining it so I remember what I did.

https://nowicki.io/self-hosting-lvm-raid1-with-key-over-ftp/

How do you even encrypt a server so that it doesn’t require human intervention every time it goes down/restarts?

Have you tried secure-erasing a disk?

Absolutely yes, I do enctypt my drives so I don't have to ever do that again. This isn't as critical for SSDs but it's still a good idea. Even if you keep the key stored on the same system, securely deleting a tiny file is way easier than a whole disk.

Always, if nothing else it makes "wiping" them securely easier.

I used to until I realized that I’ve got bigger threats to worry about.

And like someone else mentioned, if I have to do data recovery for some unknown reason I want to make sure the data’s not encrypted.

It's a relatively low performance hit and it benefits me when having to replace a failing/old disk. I can just toss the drive without having to erase the data first, that is as long as the key is a secure length.

I use full disk encryption for every server (and other computers).

Encrypting your data drives is a must for everyone imho. Encrypting the OS is a must for me🤷‍♂️

I encrypt devices that are portable. If someone raids my house I have bigger fish to fry.

Yes.

My home server has dropbear-initramfs installed so that after reboot I can access the LUKS decryption prompt over SSH. The one LUKS partition contains a btrfs filesystem with both rootfs and home as subvolumes. For all the other drives attached to that system, I use ZFS native encryption with a dataset that decrypts with a keyfile from that rootfs and I have backups of an encrypted copy of that keyfile.

I don't think there's a substantial performance impact but I've never bothered benchmarking.

No. If someone gets to my server that’ll be the least of my worries.

On laptops yes, on my server no. Most of the data is photo backups and linux ISOs form over the years.

In addition to "encryption at rest", also consider that your devices might be exploited over the internet, so attackers may be able to access the decrypted state that way. To guard against that, you may wish to encrypt certain documents with an additional password, even if they are sitting on an encrypted file system.

Recall that within a month, the widely SSH was exploited and a backdoor added to every machine. I had upgraded to that SSH version. I didn't run an SSH server on that box, but it goes to show that even those who take precautions can end up exploited!

No. I run my servers on low quality shit and I expect them to break any time. Never had to perform a data recovery but if I need, I'll thank myself I didn't encrypt my pics

Yes, all, no matter what data is, it's not hard and doesn't have any consequences, but protects from many inconvenient accidents

Yes.

I encrypt about everything. Laptop, server, backups, external hdds that are just for me. (Only thing I don't encrypt is a VPS. It's hosted on somebody else's hardware and they'd be able to break the encryption anyways if they wanted.)

I just put LUKS on it before formatting a filesystem. For the OS I use the good old approach with LUKS and a LVM inside.

I mean if you don't encrypt the backups, the encrytion of the system is kind of meaningless, isn't it?

No

I want to, but haven't found the time to make a strategy on how to move over the data. It would take a bunch of shuffling as all drives are in use. The next problem is decrypting at boot and securely storing the decryption key - if I choose to use a decryption key at all. Maybe it'll be a usb key that I have to plug into the server when starting it, or I have to setup decryption of the system over SSH, but that means automated restarts are... difficult.

Not sure how to tackle the problem yet...

Yup and negligible. If I'm forced to contend with a windows environment bitlocker is utilized.

I also utilize a ram disk in a windows os. Imdisk in windows. I migrate temp files and logs into the ram disk. It saves on disk writes and increases privacy.

If pretty straightforward to encrypt if utilizing Linux right from install time.

As for my server I too utilize nextcloud. However, the nextcloud data is on a zfs dataset. This dataset is encrypted.

I did this by installing nextcloud from docker running within a proxmox container. That proxmox lxc container has the nextcloud dataset passed into it.

I have two WebDAV shares, one unencrypted and one encrypted. The unencrypted one is for things that need to be read by other services, like legally obtained movies and tv shows. The encrypted one is for porn, mostly (also stuff like tax documents, legal contracts, etc).

This is the server I use

https://hub.docker.com/r/sciactive/nephele

It’s really easy to set it up for encryption. Also, I wrote it. :)

I did have LUKS and a USB flash drive with a key to be inserted on boot. It was definitely difficult and caused performance issues. It was particularly difficult to add/remove drives from the array. These days I only encrypt my off-site backups that sit at the office where my coworkers potentially have physical access.

There have been recent advancements in TPM so disk encryption is easier to maintain and doesn't affect performance. I'll need to investigate this one day. My server/NAS is a 4th-gen i5, so it may not support the functions I would need. Full disk encryption will land in Ubuntu soon. I'm hanging out for that.