This is a quick summary of how to set up encryption during the installation of a Debian based system. It is actually not full disk, but full partition. It assumes you want a separate /, /home and swap, all encrypted. It uses LUKS and dm-crypt. For a detailed explanation, see https://xo.tc/full-disk-encryption-on-linux.html.

This is a summary of the excellent article at [https://xo.tc/setting-up-full-disk-encryption-on-debian-jessie.html]. I'm writing this more because he is very, very detailed with lots of pretty pictures, and I wanted a quick and dirty. Thus, if you want to “know” what you're doing, read his article. If you are pretty sure what you're doing and just want a recipe, use this.

• Figure out a good passphrase; something you'll remember (you'll type it everytime you boot), but is hard to crack (it secures all your data). I use https://xkpasswd.net/s/ to generate memorable but secure passphrases.
  • For very, very secure, use the default generator.
  • For less secure, but easier to remember, use the XKCD preset (when I do this, I set the SEPARATOR char to random).
• Do a base Devuan install. Should work for any Debian derivative.
• On partitioning scheme, create the following. NOTE
  • Partition 1, Primary, 256M, ext4, /boot
  • Partition 5, Logical, 10G, Physical volume for encryption
  • Partition 6, Logical, disk size minus 4G, Physical volume for encryption
  • Partition 7, Logical, 4G, do not use the partition
• Configure encrypted volumes
  • Create Encrypted Volumes
  • Select sda5 and 6 (/ and /home), then Continue, then Finish
• Enter the passphrase for both / and /home. Note that /home's password will be overridden later, so not critical
• Set sda5_crypt (the 10G one) as ext4, mount point /
• Set sda6_crypt (the big one) as ext5, mount point /home
• Done with partitioning, and select “no” when it complains about the lack of swap (we'll create it later)
• Finish installation as you like and reboot system
• Log in as root (or become root)
• Set up swap partition. This uses a random key generated at boot time, so each boot generates a new key. Following are the two commands to do that, adding a new line to /etc/crypttab and /etc/fstab
  • echo 'sda7_crypt /dev/sda7 /dev/urandom swap' » /etc/crypttab
  • echo '/dev/mapper/sda7_crypt none swap sw 0 0' » /etc/fstab
• Set it up so /home's partition actually uses a key (stored on /) with no passphrase. Again, the following are the commands from a prompt

mkdir /etc/keys
dd if=/dev/random of=/etc/keys/sda6.key bs=1 count=32 # create 32 byte key
chmod 400 /etc/keys/sda6.key
# add key file to /dev/sda6. When asked, use the key you created during install
cryptsetup luksAddKey /dev/sda6 /etc/keys/sda6.key # add key to /home
# now, remove the key you used at install for sda6 (you'll be asked which to to remove)
cryptsetup luksRemoveKey /dev/sda6

• edit /etc/crypttab, find sda6_crypt, change 'none' to /etc/keys/sda6.key

At this point, you should be able to reboot. You will be asked one time for the encryption key (the one for sda5, to be mounted on /). sda6 (mounted /home) should be decrypted automatically as soon as / is mounted and key can be found, and swap should also be mounted with a generated key.

Don't forget to Donate. The xkpasswd site is free, but they have to pay for hosting. Devuan is also free, but they have a lot of overhead. Donating to them ensures they are able to continue development of a systemd free Linux.