Full disk encryption on the server.

[jmg1138]

Currently during alpha/development on the staging server that runs Debian Linux, system/volume disk encryption is using DigitalOcean defaults. Should additional encryption be enabled?

System disk

This might be difficult if it requires a LUKS decryption password to be entered on every boot/reboot.

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Database data volume

The servers are currently being hosted by DigitalOcean. The database data is stored on a separate mounted volume.

How to Create an Encrypted File System on a DigitalOcean Block Storage Volume

DigitalOcean Volumes are encrypted at rest, which means that the data on a Volume is not readable outside of its storage cluster. When you attach a Volume to a Droplet, the Droplet is presented with a decrypted block storage device and all data is transmitted over isolated networks.

For additional security, you can also create a file system in a LUKS encrypted disk on your Volume. This means that the disk will need to be decrypted by the operating system on your Droplet in order to read any data.