I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server.
- I want this to be as simple as possible. As few external tools as possible.
- The gitignore file of this repository would ignore every file besides
- To increase the simplicity I will not obfuscate the filename of the encrypted file. I plan to just be cautious about the filename and not put sensitive stuff inside the file.
- The encryption and decryption would be done with an asymmetric key, and this very asymmetric key would be also included in the repostiory, AES256 encrpyted.
- Maybe, I could also sign each commit with the asymmetric key which lies encrypted in the repository itself. That would prevent an attacker to manipulate something. But I also don't know if it is worth to do that?
- As my laptop has disk encryption, I don't care about plaintext files lying around in this repo (because I edit stuff inside, read them, etc.)
- Being a git repository, I could mirror it to multiple remote repositories.
For that, I have three questions:
Is this safe? Obviously random people will have access to my remote repository. Of course, I could make the repository private and not use github, gitlab or something like that - but the sysadmin of the server will have access to this repo, no matter what.
- At least, I am not competent enough to, for instance, encrypt the filesystem in such a way that I can confidently say that this remote repository will be secure.
What key algorithms should I use? Should I use ed25519 (which I trust the most out of ECC's at the moment - although I just superficially read about it) Or should i use RSA 4096 or even bigger?
I do not know if I should use gpg2 or rage?
- I dislike the complexity of gpg, but rage is a very young project. (And I dislike Golang, therefore I also dislike to use the its reference implementation age.)
- I will never need the legacy options of gpg, so i will always be able to use version 2+.