I'd like to protect the data on my Linux server from physical theft by using encrypted partitions with a keyfile stored on another server on my network. The other server would actually be my router, which is very small, in a different physical location to the server, and accessible over ssh.I figure the chances of someone stealing the server from one location, breaking into a second location, finding and stealing the router, and subsequently setting them both up in the same network, are pretty slim. It means my server will always reboot and start all services as long as it's connected to my network, but my important data is protected if it ever leaves the building.The boot sequence would be something like:mount non-encrypted logical partitions (/, /var, /tmp etc.)start networkingobtain key from the other server over sshunlock the encrypted physical partitionmount the encrypted logical partitions (/home, /opt etc.)start other services which will have been configured to use the encrypted partitions - e.g. DockerI don't know how to hook into the LVM / crypto boot sequence to insert a script to get the key, nor do I know how to change the boot sequence so that the network is started before that step.The root user on the Linux box would have an ssh key set up on the router such that it could ssh with no password, something like:PASSPHRASE=$(ssh router cat /config/disk-passphrase.txt)cryptsetup luksOpen /dev/sda6 sda6_crypt <<< $PASSPHRASEThis is the disk layout I have so far, although I'm open to changing it if necessary:NAME                         FSTYPE    LABEL UUID                                   MOUNTPOINTsdasda2sda5                       LVM2_memb       fjRt18-XKFm-z3RN-1D7t-zkuw-sMal-KyOZ6Z garage--main--vg-tmp     ext4            e90a6186-bf09-41f7-b8bc-392e0fba2207   /tmp garage--main--vg-var     ext4            ee878d29-3b44-463f-adba-083155ea29da   /var garage--main--vg-root    ext4            f4fa0962-3c2c-456c-9ee0-84c47d6c12c9   /sda1                       ext4            60d06dea-a07b-4af3-bf30-70fa3f82267d   /bootsda6                       crypto_LU       31b7b643-188c-4ae9-bac6-75316b37d562  sda6_crypt               LVM2_memb       ynUOJB-iRsP-djql-Tzrl-nfHh-Smga-ji4OcT    garage--enc--vg-opt    ext4            2f149989-f64c-4cab-8a47-fea80ebf4c8e   /opt    garage--enc--vg-swap_0 swap            bab96476-7209-42c7-9f2a-113dd5c4da67   [SWAP]    garage--enc--vg-home   ext4            c73b9432-ec32-412c-baa4-1329adef9c56   /home
Encrypted LVM automount at boot with key on another server
lvm;disk encryption