File-based encryption for sensitive directories via gocryptfs + GNOME Keyring.
Encrypted ciphertext is stored in a hidden directory; plaintext is mounted via FUSE. The passphrase is stored in GNOME Keyring for automatic unlock.
yay -S keys-vaultgitpkg install keys-vaultgit clone https://github.com/fkzys/keys-vault.git
cd keys-vault
sudo make installConfiguration is read from (in order, later values override earlier):
/etc/keys-vault.conf— system-wide defaults$XDG_CONFIG_HOME/keys-vault.conf(default:~/.config/keys-vault.conf) — per-user overrides- CLI flags (
--dir,--cipher-dir)
| Variable | Default | Description |
|---|---|---|
PLAIN_DIR |
~/keys |
Plaintext mount point |
CIPHER_DIR |
Derived from PLAIN_DIR |
Encrypted ciphertext directory |
CIPHER_DIR is derived as a hidden directory with .enc suffix in the same parent: ~/keys → ~/.keys.enc, ~/secure/vault → ~/secure/.vault.enc.
keys-vault init # create vault (random or user-supplied passphrase)
keys-vault open # mount
keys-vault status # open / locked / stale / not initialized
keys-vault close # unmount
keys-vault passwd # rotate passphrase# Via flag
keys-vault --dir=~/secure/credentials init
# Via config
echo 'PLAIN_DIR="${HOME}/secure/credentials"' > ~/.config/keys-vault.conf
keys-vault init| Command | Description |
|---|---|
init |
Create encrypted volume, store passphrase in keyring |
open |
Mount vault; recovers stale mounts; no-op if already mounted or not initialized |
close |
Unmount vault; handles stale mounts; no-op if not mounted |
status |
Print state: open / locked / stale / not initialized |
passwd |
Rotate gocryptfs passphrase and update keyring |
| Option | Description |
|---|---|
--dir=PATH |
Plaintext mount point (default: ~/keys) |
--cipher-dir=PATH |
Encrypted ciphertext directory (default: derived from --dir) |
-h, --help |
Show usage |
--version |
Show version |
A user service is included for automatic mount on login:
systemctl --user enable --now keys-vault.serviceThe service mounts on start (After=gnome-keyring-daemon.service) and unmounts on stop.
Custom directories configured via ~/.config/keys-vault.conf are picked up by the service automatically. For per-flag overrides, create a service drop-in:
systemctl --user edit keys-vault.service[Service]
ExecStart=
ExecStart=/usr/bin/keys-vault --dir=%h/secure/credentials open
ExecStop=
ExecStop=/usr/bin/keys-vault --dir=%h/secure/credentials closeIf the gocryptfs process dies (e.g. OOM kill) the FUSE mountpoint becomes stale — it appears in /proc/mounts but stat fails with "Transport endpoint is not connected".
opendetects this and force-unmounts before re-mountingclosedetects stale mounts and force-unmounts themstatusreportsstaleas a distinct state
- gocryptfs
secret-tool(libsecret)fusermount(fuse2 or fuse3)- GNOME Keyring (or any Secret Service provider)
AGPL-3.0-or-later