Hidden S3 — encrypted self-hosted S3 storage

This is S3-compatible object storage for sensitive data on privately managed infrastructure. It provides filesystem-level encryption independently of the S3 layer while maintaining full S3 compatibility.

Built on gocryptfs and VersityGW, the system combines encrypted storage with an S3-compatible gateway. VersityGW provides the S3 API, IAM, and WebGUI, while FastAPI manages the storage lifecycle through an OpenAPI interface.

It runs as a Docker container with persistent state stored in two volumes: cipherdir for encrypted data and a bind-mounted secrets volume for internal secrets. The secrets volume can reside on removable media or a separate remote host.

The cipherdir is mounted through gocryptfs using an encrypted passphrase stored in secrets and unlocked with a master password. When unmounted, the data remains encrypted and inaccessible.

The encrypted filesystem uses a POSIX layout, storing S3 objects as regular files and directories together with IAM data. This allows files and directories to be transferred directly into or out of the storage without conversion.

For emergency recovery, the…