Something that wasn't obvious to me: unless working with extremely limited hardware where performance is a concern, there's no reason not to use full disk encryption on a Linux machine in 2023, including for machines you want to be able to boot non-interactively.

You can configure the boot loader to try the empty passphrase, or look for a key file on a plugged in thumb drive which you can remove to disable boot. You can later re-key the encrypted volume as appropriate, without re-formatting.

@dwf Good reminder to use encryption.

Right now I am formatting my new backup hard disk with luks encryption on my #Ubuntu machine. The disk is 5TB and the initial formatting already took ~20 hours. That waiting is a bit surprising... ;-)