Encrypt your data

Nifty keeps everything in /var/lib/nifty and doesn't encrypt it itself. If you encrypt the disk that folder is on, everything Nifty writes is covered. This includes the database, files, secret.key, working files and the copies made before updates.

Encryption protects a disk that's lost, stolen or thrown away. It doesn't protect a running computer that someone has broken into, so keep the computer updated and reach Nifty only over HTTPS or Tailscale.

Choose a way

Your server	Do this
A new machine	Choose to encrypt the disk when you install Linux. Then install Nifty.
A machine Nifty already runs on	Give Nifty an encrypted disk
A rented cloud server	Turn on your provider's volume encryption. It protects their discarded disks, not against the provider, who controls the machine.

Encrypting the whole disk when you install the system is best, because it covers swap and the system's own files too. The computer asks for a passphrase each time it starts, unless you set it up to unlock with its TPM chip. Your distribution's guide explains how.

Give Nifty an encrypted disk

On a computer you've already set up, put /var/lib/nifty on its own encrypted disk or partition. These steps use /dev/sdb. To find the name of your disk, use lsblk.

1. Stop Nifty with sudo systemctl stop nifty.

2. Encrypt the disk, choosing a passphrase, and format it.

   sudo cryptsetup luksFormat /dev/sdb
   sudo cryptsetup open /dev/sdb nifty
   sudo mkfs.ext4 /dev/mapper/nifty

3. Copy Nifty's data onto it, and keep the old folder until you've checked the copy.

   sudo mount /dev/mapper/nifty /mnt
   sudo rsync -aHAX /var/lib/nifty/ /mnt/
   sudo umount /mnt
   sudo mv /var/lib/nifty /var/lib/nifty.old
   sudo mkdir /var/lib/nifty

4. Stop Nifty from starting on an empty folder while the disk is locked.

   sudo mkdir -p /etc/systemd/system/nifty.service.d
   printf '[Unit]\nRequiresMountsFor=/var/lib/nifty\n' | sudo tee /etc/systemd/system/nifty.service.d/encrypted.conf

5. Choose how the disk unlocks (see below), and then start Nifty with sudo systemctl daemon-reload && sudo systemctl start nifty.

6. Once you've checked that your notes are all there, delete the old copy with sudo rm -rf /var/lib/nifty.old.

The old copy was on the unencrypted disk, and deleting it doesn't scrub it. To be sure nothing is left, encrypt the whole disk.

Unlock when the machine starts

Way	Restarts	Protects
The TPM chip	By themselves	The disk taken out of the machine
A passphrase	Nifty waits until you unlock it	The disk, and the whole machine taken

With the TPM chip

With a TPM chip, the computer unlocks the disk itself, so it can restart without you. Most PCs have a TPM chip, but cloud servers often don't.

sudo systemd-cryptenroll --tpm2-device=auto /dev/sdb
echo "nifty UUID=$(sudo cryptsetup luksUUID /dev/sdb) none tpm2-device=auto,nofail" | sudo tee -a /etc/crypttab
echo "/dev/mapper/nifty /var/lib/nifty ext4 nofail 0 2" | sudo tee -a /etc/fstab

With a passphrase

With a passphrase, the disk stays locked until you unlock it. Nifty doesn't start when the computer starts. Start it yourself after each restart, and it asks for the passphrase.

echo "nifty UUID=$(sudo cryptsetup luksUUID /dev/sdb) none noauto,nofail" | sudo tee -a /etc/crypttab
echo "/dev/mapper/nifty /var/lib/nifty ext4 noauto,nofail 0 2" | sudo tee -a /etc/fstab
sudo systemctl disable nifty

After a restart, run sudo systemctl start nifty.

Keep a recovery key

If you forget the passphrase, or the TPM chip changes because of a new motherboard or a firmware reset, the disk can't be read. Make a recovery key and keep it in a password manager, away from the server.

sudo systemd-cryptenroll --recovery-key /dev/sdb

You can use the recovery key wherever the passphrase is asked for.

Check it's working

findmnt /var/lib/nifty

The command shows /dev/mapper/nifty. If it shows nothing, the disk is locked.

Your backups

Put /var/lib/nifty-backups on the encrypted disk too, or choose a backup folder there. Copies that leave the computer aren't protected by the disk's encryption, so encrypt them with a tool you trust first. See Backups.