Advanced Usage

Compression

Compress files before encryption to save space, especially for text files and archives:

# Encrypt with compression
nokvault encrypt large-file.txt --compress

# Compression is automatically detected during decryption
nokvault decrypt large-file.txt.nokv

Compression is particularly effective for text files, JSON, XML, and other compressible formats. Binary files may not compress much.

Auto-Encryption with File Watching

Automatically encrypt files when they are created or modified in a directory:

# Watch directory and auto-encrypt
nokvault watch ./sensitive --auto-encrypt \
  --keyfile ~/.keys/master.key \
  --delay 5s \
  --exclude "*.tmp"

The --delay option prevents encrypting files that are still being written. The watcher runs until you stop it with Ctrl+C. A symlink watch root is refused at startup; symlink events are rejected and never encrypted. Policy errors print without --verbose.

Scheduled Encryption

Set up periodic encryption for automated backups and regular encryption tasks:

# Encrypt backups every hour
nokvault schedule encrypt ./backups --interval 1h --keyfile ~/.keys/backup.key

# Encrypt daily at midnight (using cron on Linux/macOS)
# Add to crontab: 0 0 * * * nokvault encrypt /path/to/docs --keyfile ~/.keys/master.key

Scheduled encryption is useful for maintaining encrypted backups of important directories. Each run re-validates the configured path and generated outputs before writing; a symlink or escaping output aborts that tick.

Key Rotation

Re-key an encrypted file by decrypting with the old credential and re-encrypting with a new one (new salt and ciphertext):

# Rotate key for a file
nokvault rotate-key file.nokv

# Rotate with specific keyfiles
nokvault rotate-key file.nokv \
  --old-keyfile ~/.keys/old.key \
  --new-keyfile ~/.keys/new.key

Key rotation is recommended periodically, especially if a key might have been compromised.

Secure Deletion

Best-effort overwrite and delete sensitive files:

# Secure delete with default passes (interactive: type yes)
nokvault secure-delete sensitive-file.txt

# Non-interactive / CI
nokvault secure-delete sensitive-file.txt --yes

# Preview first
nokvault secure-delete sensitive-file.txt --dry-run

# Secure delete with more passes
nokvault secure-delete sensitive-file.txt --yes --passes 7

This is best-effort on traditional spinning disks. SSD wear leveling, snapshots, and copy-on-write filesystems may retain prior data; it is not a guaranteed forensic wipe.

Batch Operations

Encrypt or decrypt multiple files using shell loops:

# Encrypt all .txt files in current directory
for file in *.txt; do
  nokvault encrypt "$file" --keyfile ~/.keys/master.key --no-prompt
done

# Decrypt all .nokv files
for file in *.nokv; do
  nokvault decrypt "$file" --keyfile ~/.keys/master.key --no-prompt
done

Verbose Output

Get detailed information about operations:

# Verbose encryption
nokvault encrypt ./documents --verbose

# Shows progress, file counts, and detailed status