Hector Martin

Don't want to have to decrypt swap every boot, would be nice if that was automatic, but at the same time I'm not 100% sure doing lvm inside luks and then putting both swap and os inside lvm is a good idea. Idk.

Oh? How exactly does that work? Decrypt one and it does the rest for you?

I mean, it's encrypted as a single continuous chunk, so there's not really a benefit to 3 keys for 3 partitions instead of one, no? Idk, this is why I ask, my threat models may be totally bogus.

Yeah I think I'm going to do this. Encrypt the main block, and then lvm after encryption.

If all the volumes are on the same platter then CPU usage won't go up. You're I/O limted anyway. You can always encrypt multiple volumes then store the volume keys in the root filesystem and have them automatically decrypt on boot. In the end it depends on what exactly you want.