Encryption

My source files encrypted with symmetric key encryption via GPG¹. This enables my workflow of storing my personal notes anywhere, including checked in to a public source repository. Emacs can cache the GPG¹ password if you trust your session. Pinentry² handled within Emacs to remain compatible without the Desktop module.

Configuring the gpg-agent

When the gpg-agent¹ loads it will read the configuration at ~/.gnupg/gpg-agent.conf. Override the default settings to allow Emacs to function as the Pinentry² application.

allow-emacs-pinentry
allow-loopback-pinentry

Restarting the gpg-agent

You may need to restart the gpg-agent¹ to load the configuration without rebooting.

gpgconf --reload gpg-agent

Creating a symbolic link

Create the symbolic link to the configuration file

(dotfiles/symlink "~/.emacs.d/config/gpg-agent.conf"
                  "~/.gnupg/gpg-agent.conf")

Setting up pinentry in Emacs

With the Pinentry² package for Emacs prompts will now appear in the minibuffer. Increase the minimum prime bit size to increase performance during symmetric encryption.

(use-package pinentry
  :custom (epa-file-select-keys 2)
          (gnutls-min-prime-bits 4096)
          (epa-pinentry-mode 'loopback)
          (epa-file-encrypt-to dotfiles/public-key)
          (epa-file-cache-passphrase-for-symmetric-encryption t)
  :config (pinentry-start))

Including *.gpg files

Override org-agenda-file-regexp to include .org.gpg files.

(unless (string-match-p "\\.gpg" org-agenda-file-regexp)
  (setq org-agenda-file-regexp
    (replace-regexp-in-string "\\\\\\.org" "\\\\.org\\\\(\\\\.gpg\\\\)?"
      org-agenda-file-regexp)))

Encrypting roam files

Irrelevant without the Writing module, encrypt new files from capture templates.

(with-eval-after-load 'org-roam
  (setq org-roam-encrypt-files t))

Managing passwords

Pass³ makes managing passwords easy, encrypring them in a file structure and providing easy commands for generating, modify, and copying passwords. Password-store.el⁴ provides a wrapper for the functionality within Emacs.

(use-package password-store
  :custom (password-store-dir dotfiles/passwords))

Configure keybindings behind SPC p.

Copy with p
Rename with r
Generate with g

(dotfiles/leader
  "p" '(:ignore t :which-key "Passwords")
  "pp" '(password-store-copy :which-key "Copy")
  "pr" '(password-store-rename :which-key "Rename")
  "pg" '(password-store-generate :which-key "Generate"))