Crypt

LUKS

Encrypted Container (LUKS) over NFS

Prerequisites

• TrueNAS with NFS share already exposed
• Linux client with NFS share mounted
• Packages: cryptsetup

1. Create the image on TrueNAS

# 64 GiB pre-allocated image
dd if=/dev/zero of=/mnt/mainframe/.local/containers.img bs=1M count=65536 status=progress

2. Attach as loop device (Linux client)

losetup -fP --show /mnt/sektor/.local/containers.img
# → note the device name, e.g. /dev/loop0

3. Format with LUKS2

cryptsetup luksFormat --type luks2 /dev/loop0
# Type YES and choose a strong passphrase

4. Open and create filesystem

cryptsetup open /dev/loop0 containers
mkfs.ext4 /dev/mapper/containers

5. Mount

mkdir -p /mnt/rayden
mount /dev/mapper/containers /mnt/rayden

6. Backup LUKS header — do this now

cryptsetup luksHeaderBackup /dev/loop0 --header-backup-file ~/containers-luks-header.bak
# Move the .bak off the machine immediately

Daily open/close

# Open
losetup -P /dev/loop0 /mnt/sektor/.local/containers.img
cryptsetup open /dev/loop0 containers
mount /dev/mapper/containers /mnt/rayden

# Close
umount /mnt/rayden
cryptsetup close containers
losetup -d /dev/loop0

Notes

• Encryption is AES-256-XTS via LUKS2 — hardware accelerated if CPU has AES-NI (grep aes /proc/cpuinfo)
• TrueNAS never sees decrypted data — key lives on the Linux client only
• NFS traffic is unencrypted in transit — add WireGuard if the network is untrusted
• Never open the container from two clients simultaneously
• Always close cleanly before shutdown — crash during idle/read is safe, crash during write risks the file being written
• Store the passphrase in a password manager