Drive Encryption in XenServer

Encryption of local disks (not system), the task as it turned out is quite simple.
1. Select a partition for future encrypted storage.
fdisk -l
On a clean installation on a single disk system, this will be / dev / sda3. For example, I will use it.
approx. XenServer uses GPT instead of MBR, so the fdisk listing may contain error information. Partition editing is better than gdisk, partx or parted.
2. Check what storage facilities we already have. If our target partition is already in use, you will have to delete the corresponding local storage.
Obtaining the SR-UUID of the storage
xe sr-list
Before deleting the storage, you will have to remove the PBD. Disable and delete PBD first, and then SR. 3. Create an encrypted partition.
xe sr-param-list uuid= | grep PBD

xe pbd-unplug uuid=
xe pbd-destroy uuid=
xe sr-destroy uuid=
xe sr-forget uuid=

cryptsetup -c aes-cbc-essiv:sha256 -s 256 luksFormat /dev/sda3
We enter the password for the section and YES in confirmation of our intentions.
4. We connect our section
$ cryptsetup luksOpen /dev/sda3 fs_point
fs_point - this is the name under which the section will be available in the system, choose at your discretion.
The encrypted partition will be available on the system as / dev / mapper / fs_point.
5. We connect the encrypted partition as local storage
We receive UUID
xe host-list
And we connect SR
xe sr-create content-type=user device-config:device=/dev/mapper/fs_point host-uuid=$host_uuid name-label="Local Storage - Encrypted" shared=false type=lvm
6. After server reboot it is necessary to decrypt the partition manually and connect sr.
Deciphering the cryptsetup luksOpen /dev/sda3 fs_point
Connection section sr xe pbd-plug uuid=uuid хранилища(можно посмотреть в xencenter или в xe sr-list)
It is convenient to make a script for these two commands.