Encrypted LUKS Workspace

Usage

WELCOME TO ELWORK (encrypted luks workspace)!
Usage: ./elwork.sh [OPTIONS]
       --action      Perform an action on the workspace name. Valid options include: list, new, rotate, unschedule, mount, unmount, passwd, remove, archive, replace, change (default = 'list')
       --encrypt     Flag to enable luks encryption (default = 'false')
       --log         Path to log file (default = './elwork.sh.2024-07-06.log')
       --name        Name of the workspace to manage. (default = 'andrei_workspace_2024-07')
       --parent      Path to store workspaces and index of elwork. (default = '/home/andrei/.elwork')
       --password    Password to encrypt/decrypt the luks workspace (default = 'T3stP@ssw0rd!')
       --size        Size of the workspace. Valid options include: cd (650 MB), dvd (4500 MB), dvddl (8500 MB), bd (24000 MB), bddl (48000 MB) or any #[M|G|T]B. (default = '650')
       --sudo        Flag to enable sudo before running commands (default = 'false')
       --type        Type of filesystem to use. Valid options include: xfs, ext4 (default = 'xfs')

Examples

List workspaces

./elwork.sh --action list                                                      

WELCOME TO ELWORK (encrypted luks workspace)!
LIST

[INFO] Correcting permissions on --parent...
[SUCCESS] Script has completed execution!

Create new workspace

./elwork.sh --name my-secrets --action new --size bd --type xfs --encrypt --sudo

WELCOME TO ELWORK (encrypted luks workspace)!
Enter password: 
Confirm password: 
[SUCCESS] We've accepted your password! This will be used for encrypting your new workspace.
[INFO] Creating disk image at /home/andrei/.elwork/.disks/my-secrets_2025-05.img with a size of 24000MB...
24000+0 records in
24000+0 records out
25165824000 bytes (25 GB, 23 GiB) copied, 15.0734 s, 1.7 GB/s
[INFO] Formatting the disk image with LUKS...
[INFO] Creating disk /home/andrei/.elwork/.disks/my-secrets_2025-05.img...
[INFO] Creating filesystem on disk image...
meta-data=/dev/mapper/encrypted-elwork-my-secrets-2025-05 isize=512    agcount=4, agsize=1534976 blks
         =                       sectsz=4096  attr=2, projid32bit=1
         =                       crc=1        finobt=1, sparse=1, rmapbt=0
         =                       reflink=1    bigtime=1 inobtcount=1 nrext64=0
data     =                       bsize=4096   blocks=6139904, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0, ftype=1
log      =internal log           bsize=4096   blocks=16384, version=2
         =                       sectsz=4096  sunit=1 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0
[INFO] Mounting drive to your system...
[INFO] Creating workspace symbolic link...
[SUCCESS] Created new workspace my-secrets of 24000MB accessible at /home/andrei/el-my-secrets!
[INFO] Correcting permissions on --parent...
[SUCCESS] Script has completed execution!

Mount workspace

./elwork.sh --action mount --name my-secrets --encrypt true --password --sudo

WELCOME TO ELWORK (encrypted luks workspace)!
[INFO] Mounting filesystem...
[INFO] Decrypting filesystem...
Device encrypted-elwork-my-secrets-2025-05 already exists.
[INFO] Creating workspace symbolic link...
[SUCCESS] Mounted my-secrets to /home/andrei/el-my-secrets!
[INFO] Correcting permissions on --parent...
[SUCCESS] Script has completed execution!

Your workspace gets mounted to $HOME/el-<workspace-name>. This assumes you are using igo and have Go 1.24.3 installed. This gives you genwordpass utility with all versions of Go you install using igo.

cd ~/el-my-secrets
echo "$(genwordpass)" > my-password
ssh-keygen -t ed25519 \
           -N "$(cat my-password)" \
           -f "$HOME/el-my-secrets/id_ed25519" \
           -C "my-secrets-id-ed25519"

cat ~/el-my-secrets/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcgX8FRo2QRzw11qgVWCmfq4OnZlGIUmOvKui4hsnyH my-secrets-id-ed25519

[~]$ cd ~/el-my-secrets 

[~/el-my-secrets]$ ls -la

total 12
drwxr-xr-x. 2 andrei andrei  65 May 25 20:42 .
drwxr-xr-x. 4 andrei andrei  38 May 25 20:28 ..
-rw-------. 1 andrei andrei 464 May 25 20:42 id_ed25519
-rw-r--r--. 1 andrei andrei 103 May 25 20:42 id_ed25519.pub
-rw-r--r--. 1 andrei andrei  27 May 25 20:41 my-password

[~/work/encrypted-luks-workspace]$ ./elwork.sh --action unmount --name my-secrets --sudo

WELCOME TO ELWORK (encrypted luks workspace)!
Are you sure you wish to unmount my-secrets, via /home/andrei/el-my-secrets? (y/n): y

[INFO] Checking device usage...
[INFO] Unmounting filesystem...
[INFO] Detaching loop device...
[INFO] Removing symlink...
[INFO] Cleaning up system...
[INFO] Correcting permissions on --parent...
[SUCCESS] Script has completed execution!

[~/work/encrypted-luks-workspace]$ cd ~/el-my-secrets
▶ cd ~/el-my-secrets
cd: no such file or directory: /home/andrei/el-my-secrets

[~/work/encrypted-luks-workspace]$ cd ~/.elwork/.disks && ls --la

total 25241604
drwxr-xr-x. 2 andrei andrei          76 May 25 20:27 .
drwxr-xr-x. 4 andrei andrei          38 May 25 20:28 ..
-rw-r--r--. 1 andrei andrei         130 May 25 20:46 .index
-rw-r--r--. 1 andrei andrei 25165824000 May 25 20:46 my-secrets_2025-05.img
-rw-r--r--. 1 andrei andrei   681574400 Jul 20  2024 test01_2024-07.img

[~/.elwork/.disks]$ cat .index 

my-secrets@@@/home/andrei/.elwork/my-secrets@@@24000@@@encrypted@@@0

Unmount workspace

./elwork.sh --name my-secrets --action unmount --sudo

./elwork.sh --action unmount --name my-secrets --sudo
WELCOME TO ELWORK (encrypted luks workspace)!
Are you sure you wish to unmount my-secrets, via /home/andrei/el-my-secrets? (y/n): y

[INFO] Checking device usage...
[INFO] Unmounting filesystem...
[INFO] Detaching loop device...
[INFO] Removing symlink...
[INFO] Cleaning up system...
[INFO] Correcting permissions on --parent...
[SUCCESS] Script has completed execution!