How I encrypt my backups

Automated backups that work are mind-liberating! I've shared in the previous post how I back up my data. In this post I'll explore in detail how I handle encryption to protect my server and the insuing backup disks. What does my system solve? My encryption usage is meant to protect mostly against this threat: if a stranger has access to any of my disks while they are unenergised, they must not be able to access my data. For the backup disks this is rather simple to achieve by using full disk encryption with Linux Unified Key Setup (LUKS). For the homelab's own disk, though, it's a different story: if I use full-disk encryption, I'll have to type in my passkey during boot. But this doesn't work for me: when I'm not physically home, I still want to be able to boot my server. That's why I'm using two partitions on the server: one unencrypted, with the OS and some base services, and one fully encrypted, mounted at /home/sitegui/protected. Note that this setup does not protect against…