On my Debian systems I use mandos to unlock LUKS during boot. All done over WireGuard which is loaded inside initramfs.https://www.recompile.se/mandoshttps://github.com/r-pufky/wireguard-initramfs