share the encfs encrypted ".directory" via NFS

Question

encfs uses FUSE to mount an encrypted directory (a hidden ".directory" by convention) onto another directory specified by the user.

I want to share the encrypted ".directory" via NFS where it will be decrypted on the client (on demand).

When I try doing that the mount command succeeds and no errors are reported (even with "-vvv" parameter). However, the mount on the client is always empty. Why? How do I resolve this?

My plan is that the client will not have to keep the decrypted directory mounted at all times, thus increasing security (I hope).

The other way of sharing it, where it is decrypted on the NFS server means it will have to stay decrypted at all times (afaik).

UPDATE: I want to clarify that I am not mounting the decrypted directory on the NFS server and then trying to share that. I am trying to share the raw encrypted directory.

NFS server (192.168.1.1 fileserver)

/etc/fstab:

/home/.shared /export/home/.shared        none    bind 0 0

/etc/exports:

/export/home/.shared 192.168.1.10(fsid=2,rw,no_root_squash,sync,no_subtree_check,nohide)

NFS client (192.168.1.10)

I haved tried two approaches:
first try:

fileserver:/export/home/.shared /home/.shared  nfs4    noauto,x-systemd.automount,x-systemd.device-timeout=10,timeo=14,rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,intr,timeo=600,retrans=2,sec=sys,clientaddr=192.168.1.10,local_lock=none,addr=192.168.1.1      0 0

I have also tried:

fileserver:/export/home/.shared /home/.shared     nfs4    noauto,_netdev,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,intr    0 0

Answer 1

The data stored in the encrypted directory just looks like normal files to the filesystem (just with odd names and encrypted data). So exporting the encrypted mountpoint will work as normal.

So, on server test1 we can create a test directory:

$ cd /home/sweh
$ mkdir encrypted decrypted
$ encfs ~/encrypted ~/decrypted
[...]
$ echo hello > decrypted/foo
$ ls encrypted
C-1Ky9g41JBTIYaBJC7EeiiH

Now we can export this. /etc/exports has:

/home/sweh/encrypted *(rw,no_root_squash,sync,no_subtree_check,nohide)

And we run exports -a to export it.

Now on test2 we can mount it:

$ mkdir encrypted decrypted
$ sudo mount test1:/home/sweh/encrypted encrypted
$ ls encrypted
C-1Ky9g41JBTIYaBJC7EeiiH

And we can use this with encfs on the client:

$ encfs /home/sweh/encrypted /home/sweh/decrypted 
EncFS Password: 
$ cat decrypted/foo 
hello