How do I mount and format the storage disk on a Linux storage VPS?

Which disk is the storage disk?

Run lsblk: the storage disk is the large one with no partitions, no filesystem and no mount point. Storage VPS come in two layouts, a small system disk plus a large data disk, or a single large disk. According to Coffervale's survey of 2 November 2026, 6 of the 18 storage VPS sellers that take crypto without an ID document state on their pages that the storage arrives as a separate disk or block device; the other 12 describe one disk or do not say. Check yours before typing anything destructive.

On KVM, virtio disks are named vda, vdb and so on, and virtio-SCSI disks sda, sdb. Sizes are shown in binary units, so a 1 TB disk reads as about 931G. If lsblk lists only one disk and / already spans its full size, there is nothing to format: create a folder such as /srv/data and skip to the section on encryption choices at the end.

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS

# Use the empty disk from the list above; this example assumes /dev/vdb
DISK=/dev/vdb
PART=/dev/vdb1

Should I partition the storage disk or format it whole?

Create one GPT partition across the disk. A filesystem written straight onto the bare device works too, but a partition table tells every tool and every admin who looks later that the disk is in use, and parted aligns the partition for you. Debian and Ubuntu cloud images do not always ship parted, so install it first (dnf install parted on AlmaLinux or Rocky Linux, and the same for cryptsetup below).

apt install parted
parted -s -a optimal "$DISK" mklabel gpt mkpart data 0% 100%
partprobe "$DISK"
lsblk "$DISK"

Should I encrypt the storage disk with LUKS?

Encrypt it if anything on the VPS will keep plain files: run cryptsetup luksFormat on the partition, open it under a name, and build the filesystem on the opened device. LUKS2 is the default format. Keep the system disk unencrypted and the data disk under LUKS: after a reboot, log in over SSH and unlock the data disk with your passphrase. Whoever runs a hypervisor can technically read an unencrypted virtual disk, at any VPS host. We do not open your files, and data you encrypt before it leaves your machine takes the question off the table.

Back up the LUKS header and move the copy off the server: if the header is damaged, the data behind it is gone. The cryptsetup manual adds a warning worth reading twice: a header backup plus a passphrase that was valid when you took it decrypts the disk even after that passphrase is changed or removed. Treat the backup file like the passphrase itself.

apt install cryptsetup
cryptsetup luksFormat "$PART"
cryptsetup open "$PART" coffer

cryptsetup luksHeaderBackup "$PART" --header-backup-file /root/coffer-luks-header.img
# copy /root/coffer-luks-header.img to your own machine, then delete it here

Should the storage disk use ext4 or XFS?

Use ext4 unless you have a reason not to; it is the only one of the two you can shrink. Both handle multi-terabyte backup repositories and file sync without trouble, and both grow while mounted when a disk gets larger. The differences that matter on a storage VPS:

# The device to format: the partition, or the opened LUKS device
DEV="$PART"        # with LUKS: DEV=/dev/mapper/coffer
mkfs.ext4 -m 1 -L coffer "$DEV"
# or: mkfs.xfs -L coffer "$DEV"

How do I mount the disk at boot with fstab, UUID and nofail?

Add one /etc/fstab line that names the filesystem by UUID and carries nofail. The fstab manual recommends UUIDs or labels because device names follow the order in which disks are detected and can change when disks are added or removed. With nofail, systemd's documentation says the boot continues without waiting for the mount and whether or not it succeeds, so a detached or locked disk cannot leave a remote server stuck at an emergency prompt you cannot reach.

An encrypted disk gets noauto as well: it cannot be mounted before you unlock it over SSH, so the boot should not try. The small script below opens it by the LUKS UUID and mounts it in one step.

mkdir -p /srv/data
UUID=$(blkid -s UUID -o value "$PART")
echo "UUID=$UUID  /srv/data  ext4  defaults,nofail  0  2" >> /etc/fstab
systemctl daemon-reload
mount /srv/data
findmnt /srv/data

mkdir -p /srv/data
FSUUID=$(blkid -s UUID -o value /dev/mapper/coffer)
LUKSUUID=$(blkid -s UUID -o value "$PART")
echo "UUID=$FSUUID  /srv/data  ext4  noauto,nofail  0  0" >> /etc/fstab
systemctl daemon-reload

cat > /usr/local/sbin/unlock-data <<EOF
#!/bin/sh
cryptsetup open /dev/disk/by-uuid/$LUKSUUID coffer && mount /srv/data
EOF
chmod 700 /usr/local/sbin/unlock-data

# after each reboot, over SSH:
/usr/local/sbin/unlock-data

What if I do not want to encrypt the disk on the server?

Encrypt on the client instead, which works on any layout, single disk included. Borg, restic and Syncthing's untrusted-device mode all encrypt before data reaches the VPS, so the server stores ciphertext with or without LUKS. KVM gives your server its own kernel, so you can put LUKS on the data disk or run ZFS with native encryption, and the keys never leave you. For backups, encrypt on your own machine before upload (Borg, restic and Kopia all do it), so the server only ever holds ciphertext. Disk encryption still adds value when the VPS runs software that needs plain files, such as Nextcloud. Next steps: How do I use a VPS for off-site backups?, How do I set up a Borg backup server on a VPS? and What is the best VPS for Nextcloud with 1 TB or more of storage?. If you need a bigger disk later, To grow, order a larger plan and copy your data across with rsync or zfs send; resizing a running server in place is not offered at launch; plan sizes are on Where can I get a VPS with 1 TB of storage?.