Ubuntu *fscrypt* (Ext4 / F2FS only. See `gocryptfs` for XFS/Btrfs) https://github.com/google/fscrypt

fscrypt-enable.sh

sudo apt install fscrypt libpam-fscrypt
# encrypt only filesytem with /home (it may be in '/' filesystem)
FileSystem=$(grep -E ' (/home|/) ' /proc/mounts | grep -o '^[^ ]*')
getconf PAGE_SIZE  # 4096
# TODO check Ext2/Ext3 (FSFS, UBIFS ??)
sudo tune2fs -l $FileSystem | grep 'Block size'
sudo tune2fs -O encrypt $FileSystem
sudo fscrypt setup
sudo pam-auth-update

log out - logon

mkdir p/dehydrated
fscrypt encrypt p/dehydrated/
rsync -a nb15:p/dehydrated/ p/dehydrated/
chmod 755 p/dehydrated/

log out; login as another user

add this to .bashrc

is_unlocked() {
  if [ -z "$1" ]; then echo "Usage: is_unlocked <path>"; return 1; fi
  fscrypt status "$1" 2>/dev/null | grep -q "^Unlocked: Yes"
}

Private=$HOME/p/dehydrated
if ! is_unlocked "$Private" ; then
  echo "🔐 $Private is locked. Please enter your password to unlock."
  fscrypt unlock $Private
fi
unset Private