Re: [Trisquel-users] How to do full disk encryption.

[legimet . calc]

Before doing anything else, backup! Make a LUKS container and a volume group  
in it. This way you only have to enter one passphrase to decrypt the whole  
thing.
When creating the LUKS container, if you had unencrypted data in that part of  
the disk, you should choose to wipe it so that it can't be accessed again.  
This may take some time. Afterwards, you can create the volume group and  
partition your system however you want (I usually make 3 logical volumes: /,  
/home, and swap). It is unnecessary to create a separate unencrypted /boot  
partition as used to be the case.
Once you reach the step of installing GRUB, you will get an error. You need  
to enable GRUB's cryptodisk module so that it can decrypt the partition.  
Switch to a tty and go to the place where the installation is mounted. Edit  
the etc/grub/default file and add the following line:
GRUB_ENABLE_CRYPTODISK=y
The GRUB installation should then succeed, as well as the rest of the  
installation.

You will have to type your passphrase twice when booting up. To avoid this,  
see http://www.pavelkogan.com/2015/01/25/linux-mint-encryption/.