Again asking myself how to best add encryption at rest to my (LVM-thin) Proxmox setup...
Currently, some of my VMs have individually encrypted storage, but that doesn't work for LXC containers, and it's not a solution I can scale to many VMs due to very light host CPU resources.
I could probably shrink the existing LVM volume group as much as possible, add a new VG manually, drop LUKS on that, and then add a filesystem that I can use as VM storage back in Proxmox.
Automatic unlock would kind of defeat at least some of the purpose, so anything on this volume would be unable to start initially. (Is that something that Proxmox can handle? I assume so, it also has to be able to deal with inaccessible networked storage too.) At the same time, I need the system as such to be able to boot unattended, and spin up some bootstrap services.
Another option without doing a full reinstall would be to temporarily migrate VMs to the NAS (losing all disk snapshots, oh well), drop the LVM-thin storage volume, shrink both LVM PV and mdraid volume, and then add an encrypted ZFS in the free space instead. Would be suboptimal due to the mixture of storage setups on the same disks, but not impossible.