Encrypted Git repo with TrueCrypt and SSHFS

Let’s say you want to backup your data to a server that others have access to. If you were to use some kind of encrypted archive file, it would be a hassle to download the whole archive, save changes to it and upload it back to the server every time. By mounting a TrueCrypt volume over SSHFS you can read/write what you want without downloading and re-uploading the whole volume. Here is an implementation of that with Git.

Steps:

  1. Mount SSHFS
  2. Locally mount TrueCrypt volume from SSHFS mount
  3. Use git to backup files to mounted TrueCrypt volume
  4. Unmount TrueCrypt volume
  5. Unmount SSHFS
    Here is a script that does it all automatically.

Files in working directory:

1
2
3
4
5
6
7
.
|-- git-ssh-truecrypt.sh
|-- my_key
|-- remote_mount
`-- backup.git
2 directories, 2 files

Files on server (only the TrueCrypt volume):

1
2
3
4
.
`-- backup.git.bin
0 directories, 1 file

git-ssh-truecript.sh:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
#!/bin/sh
# Settings:
# Current working directory:
WORK_DIR=$(pwd)
# SSHFS user and host:
SSHFS_ADDR="user@hostname"
# Options to pass to SSHFS:
SSHFS_OPTIONS="-o allow_other,idmap=user"
# Location of key file for TC volume:
KEY_FILE="my_key"
# Local directory to mount SSHFS on:
SSHFS_MOUNT="remote_mount2"
# Location of TC volume on remote server:
TC_VOL_LOC="git/backup.git.bin"
# Local directory to mount TC volume on:
TC_MOUNT="backup.git"
# Local git directory:
LOCAL_REPO_LOC="/path/to/git/dir"
# Absolute location of mount:
TC_MOUNT_ABS=$(cd $TC_MOUNT; pwd)
# Mount SSHFS
sshfs $SSHFS_OPTIONS $SSHFS_ADDR: $SSHFS_MOUNT
# Mount TC volume
truecrypt $SSHFS_MOUNT/$TC_VOL_LOC -p '' --mount-options="" --protect-hidden=no -k $KEY_FILE $TC_MOUNT
# Ensure the current user owns the contents
sudo chown -R $(whoami) $TC_MOUNT
# Do git stuff here
cd $LOCAL_REPO_LOC
git commit -am "Automatic backup on $(date)."
git push $TC_MOUNT_ABS
cd  $WORK_DIR
# Unmount TC volume
truecrypt -d $TC_MOUNT
# Sleep for enough time for the TC to unmount
sleep 5
# Unmount SSHFS
fusermount -u $SSHFS_MOUNT