I think the traditional way to do that is via dm-crypt, which you can set up with an ssh server.
You can also use a network-shared file rather than a password for LUKS but it’s not as straightforward to set up as a password. If you are doing something like tailscale then it’d be unlocked as long as you are on the VPN
Typing in a password in-person at a data center would be a huge hassle, agreed
But…it’s literally what the tpm chip is for. Like there may be other options, but the tpm chip’s purpose in life is to do this thing. And it’s been doing that for a decade. Seems pretty traditional to me. But Linux folks in some venues treat it like a plague that needs to be eradicated.
I think the traditional way to do that is via dm-crypt, which you can set up with an ssh server.
You can also use a network-shared file rather than a password for LUKS but it’s not as straightforward to set up as a password. If you are doing something like tailscale then it’d be unlocked as long as you are on the VPN
Typing in a password in-person at a data center would be a huge hassle, agreed
But…it’s literally what the tpm chip is for. Like there may be other options, but the tpm chip’s purpose in life is to do this thing. And it’s been doing that for a decade. Seems pretty traditional to me. But Linux folks in some venues treat it like a plague that needs to be eradicated.
Looking at RHEL docs it seems to also work there. The same instructions probably work in Fedora but idk I’ve never done it myself
I’ve done the recommendation for opensuse and fedora, both failed to boot properly. Weirdly arch was the easy one that worked out of box.