EDIT: I misread the original question, but everything still applies. Using /dev/mmcblk0p2 below is for installing to the microSD card. To install to an external SSD/HD the device will likely be /dev/sda2. Use the appropriate device when editing cmdline.txt, crypttab, and booting for the first time via (initramfs).
The latest Ubuntu image includes cryptsetup, so you can convert the "writeable" (root) partition to LUKS using your desktop PC. I began with the 20.10 64-bit Server image.
Prepare your SD card but do not install into the RPi. Keep it on your desktop PC.
Unmount the SD card (/dev/sdc2 is my "writeable" (root) partition - yours may be different).
sudo umount /dev/sdc2
Check the partition... sudo e2fsck -f /dev/sdc2
Shrink the partition... sudo resize2fs -M /dev/sdc2
Encrypt the partition (RPi does not have hardware AES support, Adiantum seems to perform better)...
sudo cryptsetup-reencrypt --new --reduce-device-size=16M --type=luks2 -c xchacha12,aes-adiantum-plain64 -s 256 -h sha512 --use-urandom /dev/sdc2
Decrypt the LUKS partition... sudo cryptsetup luksOpen /dev/sdc2 rootfs
Expand the partition... sudo resize2fs /dev/mapper/rootfs
Mount the partition... sudo mkdir mnt; sudo mount /dev/mapper/rootfs mnt;
Edit etc/crypttab... sudo vim mnt/etc/crypttab
- Add
rootfs /dev/mmcblk0p2 none luks
Edit etc/fstab... sudo vim mnt/etc/fstab
- Change the first line to
/dev/mapper/rootfs / ext4 defaults,noatime 0 0
On the system-boot partition, edit cmdline.txt...
- change
root=LABEL=writable to root=/dev/mapper/rootfs
- remove
splash (so it prompts for the passphrase on boot)
- add
cryptdevice=/dev/mmcblk0p2:sdcard to the end of the line
It should look like this...
dwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=/dev/mapper/rootfs rootfstype=ext4 elevator=deadline rootwait fixrtc quiet cryptdevice=/dev/mmcblk0p2:sdcard
Unmount the microSD card and install into the Raspberry Pi. It will fail to boot and enter (initramfs) because initramfs hasn't been updated yet.
Manually decrypt from initramfs... (initramfs) cryptsetup luksOpen /dev/mmcblk0p2 rootfs
Continue booting... (initramfs) exit
Login (ubuntu/ubuntu) and update initramfs... sudo update-initramfs -u
Reboot... sudo reboot
It should reboot, prompt for the passphrase, then start the OS.
Best Answer
You can achieve this by following the instructions on how to install Ubuntu Server on Raspberry Pi, namely point 5: Installing a desktop.
The following desktop options are available (I checked Ubuntu Packages for Groovy):
Kubuntu:
sudo apt install kubuntu-desktopLubuntu:
sudo apt install lubuntu-desktopUbuntu Budgie:
sudo apt install ubuntu-budgie-desktopUbuntu Mate:
sudo apt install ubuntu-mate-desktopXubuntu:
sudo apt install xubuntu-desktopI didn't find any packages for Ubuntu Kylin or Ubuntu Studio, so I guess those flavors are not available as addon desktop packages for server.