CloudVault CLI

Client-side encrypted backup and restore for Google Cloud Storage.

CloudVault CLI is a Python command-line tool that encrypts files locally before upload and decrypts them after download.

Features

• backup: encrypt a file locally and upload it to Google Cloud Storage
• retrieve: download an encrypted file and decrypt it locally
• list: show available encrypted backups in a bucket/prefix
• encrypt: encrypt a local file only
• decrypt: decrypt a local file only

Requirements

• Python 3.10+
• A Google Cloud Storage bucket for cloud commands
• Google Cloud credentials (Application Default Credentials)

Install

pip install -e .

Run On Windows (PowerShell)

cd c:\path\to\cloudvault-cli
python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install --upgrade pip
pip install -e .

cloudvault --help

Local-only test:

$Pass = "change-me"
Set-Content secret.txt "hello cloudvault"
cloudvault encrypt secret.txt secret.cvault --passphrase $Pass
cloudvault decrypt secret.cvault restored.txt --passphrase $Pass
Get-Content restored.txt

Google Cloud flow:

gcloud auth application-default login

$Bucket = "your-bucket-name"
$Project = "your-project-id"
$Pass = "change-me"

cloudvault backup secret.txt --bucket $Bucket --object secret.cvault --passphrase $Pass --project $Project
cloudvault list --bucket $Bucket --prefix "" --project $Project
cloudvault retrieve --bucket $Bucket --object secret.cvault --out restored-from-gcs.txt --passphrase $Pass --project $Project
Get-Content restored-from-gcs.txt

Run On macOS (zsh/bash)

cd /path/to/cloudvault-cli
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
pip install -e .

cloudvault --help

Local-only test:

PASS="change-me"
printf "hello cloudvault\n" > secret.txt
cloudvault encrypt secret.txt secret.cvault --passphrase "$PASS"
cloudvault decrypt secret.cvault restored.txt --passphrase "$PASS"
cat restored.txt

Google Cloud flow:

gcloud auth application-default login

BUCKET="your-bucket-name"
PROJECT="your-project-id"
PASS="change-me"

cloudvault backup secret.txt --bucket "$BUCKET" --object secret.cvault --passphrase "$PASS" --project "$PROJECT"
cloudvault list --bucket "$BUCKET" --prefix "" --project "$PROJECT"
cloudvault retrieve --bucket "$BUCKET" --object secret.cvault --out restored-from-gcs.txt --passphrase "$PASS" --project "$PROJECT"
cat restored-from-gcs.txt

Tests

pytest -q

Project Structure

cloudvault-cli/
|-- README.md
|-- requirements.txt
|-- pyproject.toml
|-- cloudvault/
|   |-- __init__.py
|   |-- __main__.py
|   |-- cli.py
|   |-- crypto.py
|   `-- storage.py
`-- tests/
    |-- test_cli.py
    |-- test_crypto.py
    `-- test_storage.py