The author evaluated the integration of PostgreSQL and MySQL with the gocryptfs file system. Both databases proved unsuitable due to high overhead from frequent small read/write operations and synchronization issues, which caused system instability during unmounting.
SQLite was selected as the alternative due to its single-file architecture and compatibility with FUSE. The author tested multiple journaling modes, finding that the WAL mode caused data corruption when the file system was unmounted unexpectedly.
The final configuration utilizes the DELETE rollback mode, which proved stable. To optimize performance and avoid synchronization conflicts, the application is limited to a single Uvicorn worker, as SQLite supports only one write transaction at a time.
The deployment architecture uses a Docker container with two external volumes: cipherdir for encrypted data and a separate volume for secrets. This separation ensures that data remains inaccessible without the master password and the specific secret key.
The application manages the file system lifecycle, ensuring that decrypted data is only accessible while the storage is mounted. The system is designed to be stateless, allowing the container to be recreated without losing data, provided the external volumes and master password are preserved.
