Encrypt the root (optional)

Full-disk encryption protects the data on a machine that is stolen, resold, or returned under warranty. It does nothing for a machine that is already running and unlocked, which is worth being clear about: the threat it addresses is physical possession of the disk.

The cost is a passphrase at every boot. That is a real cost on a headless machine in another room – there is nobody there to type it – so think about where this machine lives before enabling it. A laptop is an obvious yes. A home server that must come back up after a power cut, unattended, is an obvious no.

If you want encryption

cryptsetup luksFormat --type luks2 "$ROOT"
cryptsetup open "$ROOT" cryptroot

The first command asks you to type YES in capitals, then to set and confirm the passphrase. The second unlocks it, which is what makes /dev/mapper/cryptroot appear; it asks for the passphrase you just set.

Point the rest of the chapter at the unlocked device:

ROOTDEV=/dev/mapper/cryptroot

If you do not

Skip both commands and point everything at the bare partition instead:

ROOTDEV="$ROOT"

What was just created

LUKS2 is the current on-disk format, and its defaults are good ones:

cryptsetup luksDump "$ROOT" | head -8

Version:        2
Epoch:          3
Metadata area:  16384 [bytes]
Keyslots area:  16744448 [bytes]
UUID:           0c06bb95-...
Label:          (no label)
Subsystem:      (no subsystem)
Flags:          (no flags)

The cipher is aes-xts-plain64 and the key derivation function is argon2id, which is memory-hard and therefore expensive to attack with GPUs. You do not need to choose any of this; the defaults are what you want.