artabramov/hidden repository overview

⁠Hidden S3 — encrypted self-hosted S3 storage

Hidden S3 is S3-compatible object storage for sensitive data on privately managed infrastructure. It provides filesystem-level encryption independently of the S3 layer while maintaining full S3 compatibility.

Built on gocryptfs and VersityGW, the system combines encrypted storage with an S3-compatible gateway. VersityGW provides the S3 API, IAM, and WebGUI, while a REST management API controls the encrypted storage lifecycle.

⁠References

• GitHub repository⁠
• GitHub pages⁠

⁠Quick start

Prepare the host directory for application secrets:

sudo mkdir -p /mnt/hidden/secrets
sudo mount --bind /mnt/hidden /mnt/hidden
sudo mount --make-shared /mnt/hidden

For stronger separation, mount removable media or remote storage at /mnt/hidden/secrets before starting the container.

Download the latest image:

docker pull artabramov/hidden:latest

Create and run the container:

docker run -d \
  --init \
  --restart unless-stopped \
  --cap-add SYS_ADMIN \
  --device /dev/fuse \
  --security-opt apparmor:unconfined \
  -p 8081:8081 \
  -p 9000:9000 \
  -p 8080:8080 \
  -v hidden-cipherdir:/var/lib/cipherdir \
  --mount type=bind,source=/mnt/hidden,target=/var/lib/hidden,bind-propagation=rslave \
  --name hidden \
  artabramov/hidden:latest

Open the management interface to initialize and mount encrypted storage:

Management API: http://localhost:8081/docs⁠

Once storage is mounted:

• S3 API: http://localhost:9000⁠
• WebGUI: http://localhost:8080⁠

Connect using any S3-compatible client or the WebGUI.

⁠How it works

Hidden S3 stores S3 objects and IAM data within an encrypted filesystem. Persistent state is separated into two external volumes:

• cipherdir — encrypted data and filesystem structure.
• secrets — encrypted passphrase and internal secrets, which can reside on detachable storage.

The encrypted filesystem is unlocked using a master password. Decrypted data is available only while the storage is mounted.

A watchdog monitors the application, secrets availability, and encrypted storage. When critical runtime conditions are detected, it stops the S3 gateway and unmounts the decrypted filesystem.

⁠License

Apache License 2.0