ELWORK manages LUKS-encrypted disk-image workspaces from Bash

What it is

encrypted-luks-workspace (elwork) is a Bash script that manages LUKS-encrypted disk images as self-contained workspaces on Linux. It's the kind of tool you'd use to keep SSH keys, passwords, or source trees in an encrypted file that can be mounted and unmounted like a drive.

The main entry point is elwork.sh, which accepts actions: list, new, mount, unmount, and remove. The README also lists rotate, unschedule, passwd, archive, replace, and change as valid options, though the current code implements the core five.

How it works

When you create a workspace with --action new, elwork:

1. Creates a disk image file (default 650 MB) using dd
2. Optionally formats it with LUKS via cryptsetup luksFormat
3. Builds an XFS or ext4 filesystem on the raw device
4. Mounts it and creates a symlink at $HOME/el-<name>

The disk images live in <parent>/.disks/, where parent defaults to ~/.elwork. A plain-text index file .index tracks each workspace with @@@ delimiters, storing name, mount path, size, and encryption status.

For encrypted workspaces, elwork uses the device mapper: it opens the LUKS volume as /dev/mapper/encrypted-elwork-<name>-<YYYY-MM>, mounts that, and later closes it with cryptsetup luksClose. Loop devices are detached during unmount.

Usage

The README shows a typical workflow:

./elwork.sh --name my-secrets --action new --size bd --type xfs --encrypt --sudo

This creates a 24000 MB (bd preset) encrypted XFS workspace. The --password flag can be passed on the command line, or elwork will prompt interactively with confirmation.

Mounting is similar:

./elwork.sh --action mount --name my-secrets --encrypt true --password --sudo

A password is required to decrypt an encrypted workspace, but prompting only happens if you omit --password entirely. The README's mount example passes a bare --password, which the parser turns into the literal value true; that value is not empty, so no prompt appears in the shown log and "true" would be used as the passphrase.

Unmount asks for confirmation first and checks that no processes are using the device via lsof, printing a table of PIDs if any are found.

The size flag accepts named presets (cd 650 MB, dvd 4500 MB, dvddl 8500 MB, bd 24000 MB, bddl 48000 MB) or explicit values like 1024MB, 2GB, or 1TB.

Structure

The repository is small and deliberately split:

• elwork.sh — entry point; parses args, loads dependencies, dispatches actions
• functions.sh — helpers for paths, sizes, passwords, logging, argument parsing
• actions.sh — the actual action implementations (new, mount, unmount, remove)
• validations.sh — per-action checks (root required, params present)
• header.sh — banner, color codes, default parameter registration
• tester.sh, tester.functions.sh — Docker test harness

The main modules — actions.sh, validations.sh, and header.sh — guard against being sourced standalone with a check on the INSIDE_ELWORK variable.

Testing in Docker

The repository includes a Dockerfile that builds an Ubuntu 22.04 image with all required tools (cryptsetup, xfsprogs, e2fsprogs, lsof, etc.) and copies the scripts into /app. The entrypoint is tester.sh, which installs Go via the author's igo tool, generates a random password with genwordpass, then runs through the full lifecycle: new, mount, write files (including an SSH key), unmount, and verify.

To run it locally:

./run-on-local.sh

That script loads the dm_mod kernel module, builds the image as elwork:latest, and runs it with --privileged plus device access for /dev/loop-control.

What it's for

This is a personal tool that solves a specific problem: keeping sensitive material in an encrypted file you can carry around or back up. The README shows using it to store SSH keys generated with a password from genwordpass. The README example and the Docker test harness use the author's igo and genwordpass tools, but the core elwork script does not appear to require them.

If you need encrypted, portable workspaces on Linux and prefer a shell-script approach, this is a compact reference implementation worth reading. At 58 KB across 12 files, it's small enough to audit in an afternoon.