How can I LUKS encrypt individual qubes?

[Deltem37]

Is this possible? I’d really like to encrypt my personal, vault, and anon-whonix qubes.

[Atrate]

You can create a separate pool for storing VMs that would be LUKS-encrypted and have your sensitive qubes there.

Note that unless you share your PC with someone else (and even then) this won’t do much, as your whole disk should already have been LUKS-encrypted by the Qubes installer.

[Deltem37]

I have an encrypted setup, but I would like to specially encrypt certain qubes so that if someone other than me tries to access them, they won’t open and can’t be hacked because they’re encrypted. How can I create a separate pool for the encrypted qubes?

[newqube]

Here are the simplest ways:

Encrypted Pool for Secret Hidden LUKS Encrypted AppVMs / Templates / HVMs

In this guide, we will create an encrypted storage pool for sensitive VMs - such as a vault - that is protected by its own separate LUKS passphrase. This is not your system disk password entered at boot; it is an independent passphrase used exclusively to unlock the vault pool when you choose to open it. Secret VMs are hidden when the pool is closed (hidden from app menu and qube manager). $ qvm-pool NAME DRIVER varlibqubes file linux-kernel linux-kernel vm-pool lvm_thin vault…

and GUI tool:

QubesOS Helper - dom0 GUI for qube management, Salt formulas, LUKS-encrypted pools etc

Hello Qubes forum! I’ve spent the last while building a small PyQt6 GUI for dom0 that wraps a handful of qvm-*/qubesctl workflows I kept doing manually copying files between dom0 and a qube, installing my own Salt formulas, creating qubes, checking what’s installed where. Figured I’d share it in case it’s useful to anyone else. [231] [soft] [salt] [file] [23113] What it does: File Transfer - copy files/folders between dom0 and a qube in either direction, including a remote file/folde…