SafeCall Docs

Appearance

NAS unlock after reboot ​

After Proxmox CT 500 (nas, 192.168.178.213) reboots, the gocryptfs mount is empty until you unlock it. File Browser and SFTP then show no secrets/ or evidence/ (or fail to start). This page is the reboot checklist. The passphrase is not in git; keep it in Apple Passwords.

Install and layout: secret-store.md.

Unlock ​

On the Proxmox host, or SSH into the CT:

bash
pct enter 500
# or: ssh root@192.168.178.213

Then:

bash
gocryptfs -allow_other /srv/sourcectl.cipher /srv/sourcectl
systemctl start filebrowser.service

gocryptfs will prompt for the passphrase. Do not put it in a unit file, cron job, or this repo.

File Browser is not ordered after the mount. If you enable the unit, it can come up against an empty directory; start it only after unlock.

Confirm ​

From GLaDOS or MiniVan-3 on LAN:

  1. Open http://192.168.178.213:8080 (or the port you bound) as sourcectl.
  2. secrets/keryx/ and evidence/keryx/ list files, not an empty tree.
  3. secrets/theseus/ contains unlock.hash (OA-AT-unlock done). secrets/theseus/ops/token_label_notes.txt exists (OA-AT-ops done).
  4. Optional: Finder → Connect to Server → sftp://192.168.178.213.

If the UI is empty, the mount is still locked. Unlock again before copying anything; do not recreate secrets/ on the ciphertext path.