Gocryptfs Encrypted Vaults

Overview

Gocryptfs provides encrypted directory overlays for sensitive data that doesn’t belong in git-tracked secrets or gopass. Uses AES-256-GCM encryption with scrypt key derivation.

Vault Locations

Vault Mount Point Contents

credentials

~/atelier/_vaults/mounted/credentials/

API keys, service accounts, tokens

work-sensitive

~/atelier/_vaults/mounted/work-sensitive/

Work-related sensitive documents

network-configs

~/atelier/_vaults/mounted/network-configs/

Network device configurations

personal

~/atelier/_vaults/mounted/personal/

Personal sensitive documents

Encrypted storage: ~/atelier/_vaults/encrypted/<vault-name>/

Vault Commands

Mount All Vaults

vault mount all

Mount Single Vault

vault mount credentials

Unmount All Vaults

vault umount all

Unmount Single Vault

vault umount credentials

Check Mount Status

mount | grep gocryptfs

Directory Structure

~/atelier/_vaults/
├── encrypted/           # Encrypted ciphertext (safe to backup)
│   ├── credentials/
│   │   ├── gocryptfs.conf
│   │   └── gocryptfs.diriv
│   ├── work-sensitive/
│   ├── network-configs/
│   └── personal/
└── mounted/             # Decrypted plaintext (when mounted)
    ├── credentials/
    ├── work-sensitive/
    ├── network-configs/
    └── personal/

Security Model

What’s Protected

  • At rest: All vault contents encrypted with AES-256-GCM

  • Key derivation: scrypt (memory-hard, resistant to GPU attacks)

  • Filename encryption: Enabled by default

What’s NOT Protected

  • While mounted: Contents visible in plaintext at mount point

  • Memory: Decrypted data in RAM while mounted

  • Swap: Unless using encrypted swap

Always unmount vaults when not actively using them.

Backup Considerations

Safe to Backup

  • ~/atelier/_vaults/encrypted/ - Contains only ciphertext

  • gocryptfs.conf - Contains encrypted master key (needs passphrase)

Critical for Recovery

Item Location

Vault passphrase

gopass: ARCANA/storage/gocryptfs-<vault>

gocryptfs.conf

~/atelier/_vaults/encrypted/<vault>/gocryptfs.conf
Without the passphrase AND gocryptfs.conf, vault contents are unrecoverable.

Recovery Procedure

Restore Encrypted Vault

Step 1: Restore encrypted directory from backup
rsync -av /mnt/backup/vaults/encrypted/credentials/ \
    ~/atelier/_vaults/encrypted/credentials/
Step 2: Create mount point
mkdir -p ~/atelier/_vaults/mounted/credentials
Step 3: Get passphrase from gopass
gopass show ARCANA/storage/gocryptfs-credentials
Step 4: Mount vault
vault mount credentials

If gocryptfs.conf Lost

The vault is permanently unrecoverable. The config contains the encrypted master key.

Mitigation:

  • Backup gocryptfs.conf to multiple locations

  • Include in Tier 3 COLD backups (Seagate SSDs)

  • Include in Tier 4 ARCHIVAL (M-Disc)

Initial Setup (One-Time)

Create New Vault

Step 1: Create directories
mkdir -p ~/atelier/_vaults/encrypted/newvault
mkdir -p ~/atelier/_vaults/mounted/newvault
Step 2: Initialize encrypted filesystem
gocryptfs -init ~/atelier/_vaults/encrypted/newvault
Step 3: Store passphrase in gopass
gopass insert ARCANA/storage/gocryptfs-newvault
Step 4: Add to vault script
# Edit ~/.local/bin/vault or equivalent to include new vault

Troubleshooting

"mountpoint is not empty"

Vault already mounted or stale mount. Check and clean:

ls ~/atelier/_vaults/mounted/credentials/
fusermount -u ~/atelier/_vaults/mounted/credentials

"Permission denied"

FUSE permissions issue:

sudo usermod -a -G fuse $USER

Then logout/login.

Wrong Passphrase

Gocryptfs will fail silently or with generic error. Verify passphrase:

gopass show ARCANA/storage/gocryptfs-credentials

See Also