﻿echo 'this is not actually a script'
exit 1



# dependencies
apt-get install cryptsetup cryptsetup-bin



#########################################
###                                   ###
###   creating the encrypted volume   ###
###                                   ###
#########################################

# size of encrypted volume in gigabytes
volsize=480

# encryption strength (number of seconds to verify a password attempt)
dectime=30

# !!! REMOVE THIS !!!
# smaller values for testing purposes
volsize=64
dectime=3

# create an empty file
touch /evol
chmod 0600 /evol
fallocate -z -l $((volsize*1024*1024*1024)) /evol
fallocate -d /evol

# mount the file as a block device
modprobe loop
loopdev=$(losetup -f)
losetup $loopdev /evol

# make the "device" an encrypted volume,
# this will prompt you for a password so
# do not copy-paste anything more after this command
cryptsetup luksFormat -c aes-xts-essiv:sha256 -h sha512 -s 512 -y -i $((dectime*1000)) --use-random $loopdev

# open up the encrypted volume,
# this also prompts for the password
cryptsetup luksOpen $loopdev evol

# create a filesystem inside the encrypted volume
mkfs.ext4 -T huge -E lazy_itable_init=0,lazy_journal_init=0 /dev/mapper/evol

# shutting down the encrypted volume
cryptsetup luksClose evol && losetup -a | grep /evol | sed -r 's/:.*//' | while read loopdev; do losetup -d $loopdev; done



########################################
###                                  ###
###   opening the encrypted volume   ###
###                                  ###
###==================================###
###     perform these steps now      ###
###      and after every reboot      ###
###==================================###

# create the block device
modprobe loop
loopdev=$(losetup -f)
losetup $loopdev /evol

# decrypt the volume,
# do not copypaste anything more after this command
cryptsetup luksOpen $loopdev evol

# mount the file system
mkdir /mnt/evol
mount /dev/mapper/evol /mnt/evol



########################################
###                                  ###
###   redirecting application data   ###
###                                  ###
########################################

##  say you have /var/www/sushi.com/webapp/data/binary.file
##  
##  in other words a folder named "data" managed by some software
##  and you want to move this into the encrypted volume:

# shut down any software that might access the folder
# then move it into the encrypted volume
# (we may rename it, such as from 'data' to 'seafood' for clarity)
mv /var/www/sushi.com/webapp/data /mnt/evol/seafood

# recreate the folder where the software expects it to be
mkdir /var/www/sushi.com/webapp/data

# clone the permissions from the original folder
chown --reference=/mnt/evol/seafood /var/www/sushi.com/webapp/data
chmod --reference=/mnt/evol/seafood /var/www/sushi.com/webapp/data

# then bind the encrypted folder to the empty folder
mount --bind /mnt/evol/seafood /var/www/sushi.com/webapp/data





##  after each reboot you will have to:
##
##    1. open the encrypted volume
##
##    2. redo the folder bind:

mount --bind /mnt/evol/seafood /var/www/sushi.com/webapp/data

##  all distros will automatically shut down the encrypted volume
##  as long as you use the 'shutdown' command to power off the server,
##  but if you ever wish to unmount stuff manually:

umount /var/www/sushi.com/webapp/data &&
cryptsetup luksClose evol &&
losetup -a | grep /evol | sed -r 's/:.*//' | while read loopdev; do losetup -d $loopdev; done


