# Encrypted disk by operating system

Source: https://docs.imprezahost.com/security/encrypted-disk-by-os.html

This page lists the encrypted-disk methods by operating system. A row is
**Available** only when a recorded boot proof exists. Every other row is
**Not offered**. Ordering and reinstall still follow the
[encrypted server disk](/security/encrypted-root.html) guide, which remains
Ubuntu 24.04 only.

This page is not a launch of the rows marked Not offered.

## Matrix

| System | Method | State | Evidence |
| --- | --- | --- | --- |
| Ubuntu 24.04 | LUKS2 and SSH unlock | Available | Boot proof on record (October 2026). |
| Debian 13 | LUKS2 and SSH unlock | Not offered | No boot proof is on record. |
| Debian 12 | LUKS2 and SSH unlock | Not offered | No boot proof is on record. |
| Ubuntu 22.04 | LUKS2 and SSH unlock | Not offered | No boot proof is on record. |
| Ubuntu 26.04 | Dracut | Not offered | No boot proof is on record. |
| Rocky Linux 9 and AlmaLinux 9 | Clevis and Tang | Not offered | No boot proof is on record. |
| A server already enrolled | TPM2 automatic unlock | Not offered | No boot proof is on record. |
| Windows Server | BitLocker | Not offered | No boot proof is on record. |

The Available row is the published Ubuntu 24.04 encrypted-disk image. Its
boot proof covers an order of "Ubuntu 24.04 (encrypted disk)" and the first
boot of that server. Unlock after that boot is the SSH procedure
on the encrypted server disk page. Impreza still never receives the passphrase.

TPM2 enrollment, Clevis and Tang, Dracut, and BitLocker are not ways to order
a server. A PCR change or a missing TPM does not unlock a disk that was never
offered.

## Unlock modes

On a new server, disk encryption is chosen at purchase, on a clean install.
Today the only unlock mode you can order is **SSH**: the default, and the one
with the most privacy. **TPM** and **TPM and PIN** are described here but stay
**Not offered** until a boot proof is on record; you cannot choose them yet.
If they are offered, TPM unlock is optional and stays off unless you choose it.
With TPM alone, the provider or the hypervisor can unlock the disk through the
virtual TPM. With TPM and PIN, the disk also needs a PIN that you type.

Encrypting an existing disk in place is outside this launch.