Setup full disk encryption on a Hetzner cloud CX42 machine. No fancy SSH unlock: you have to go to their web based terminal to enter the disk password on boot.
Notes:
- Their web based terminal is /weird/. You can paste things, but it looks like it's set up for a german keyboard, and many characters change ("http://" into "http;//"), sometimes it converts everything to lowercase after a while, sometimes it enters some capslocks mode. I ended up typing as much as possible by hand, and only use alphanumeric passphrases so there are no surprises when copy-pasting those.
- The (qemu) virtual machine doesn't use EFI, but Legacy Boot. Most setup instructions I found are for EFI systems.
- In the Hetzner UI click the server in the list, go to tab [ISO Images], search for "nix", and mount "NixOS 24.05 (x86_64/minimal)"
- Reboot, and open the terminal. (the's a button on the top with [>_], which is a shortcut for the terminal)