Where should grub be placed with luks encryption?

Question

linux

Encrypted the disk with luks, installed lvm inside the encrypted container, inside lvm - ubuntu server. /boot brought to a USB flash drive, but for some reason it does not boot. I don’t understand grub, too, do you need to shove it on a USB flash drive, or can it be on an encrypted disk, and only /boot on a USB flash drive?

Answer 1

Yes, grub needs to be on a flash drive with modules that can decrypt luks and see what's inside, otherwise how do you open the container? Besides, grub should be inside /boot anyway, right?
In fact, it is not necessary to take out /boot, it is enough to have a grub with modules and a minimal config on the flash drive, and then transfer control to grub, which is inside the luks container. With UEFI, you have /boot/efi and so it should be separate, so take it out to a flash drive. I wrote a detailed answer here: How to encrypt a drive with Ubuntu 16.04 installed?