diff --git a/sh/cryptsetup.sh b/sh/cryptsetup.sh
index a2d5c8b..3927886 100644
--- a/sh/cryptsetup.sh
+++ b/sh/cryptsetup.sh
@@ -50,23 +50,47 @@ rwx_crypt() {
 				crypt_mount="${mount_root}/${crypt_arg}"
 				case "${action}" in
 				"${action_open}")
-					local nbd_device="$(rwx_crypt_device)"
-					echo "device: ${nbd_device}"
-					# TODO connect device
-					# TODO open device
-					# TODO make mount directory
-					# TODO mount file system
+					local device
+					if ! device="$(rwx_crypt_device)"; then
+						rwx_log_error 4 "No device available"
+					fi
+					# connect device
+					if ! qemu-nbd --connect "${device}" "${crypt_file}"; then
+						rwx_log_error 5 "Connection failure: ${device}"
+					fi
+					# open device
+					echo "${pass_phrase}" |
+						cryptsetup luksOpen "${device}" "${crypt_arg}"
+					# make mount directory
+					if ! mkdir --parents "${crypt_mount}"; then
+						rwx_log_error 7 "Making failure: ${crypt_mount}"
+					fi
+					# mount file system
+					if ! mount \
+						--options "autodefrag,compress-force=zstd" \
+						"${crypt_map}" "${crypt_mount}"; then
+						rwx_log_error 8 "Mounting failure: ${crypt_map}"
+					fi
 					;;
 				"${action_close}")
-					# TODO unmount file system
-					# TODO remove mount directory
-					# TODO close device
+					# unmount file system
+					if ! umount "${crypt_mount}"; then
+						rwx_log_error 4 "Unmounting failure: ${crypt_mount}"
+					fi
+					# remove mount directory
+					if ! rmdir "${crypt_mount}"; then
+						rwx_log_error 5 "Removal failure: ${crypt_mount}"
+					fi
+					# close device
+					if ! cryptsetup luksClose "${crypt_arg}"; then
+						rwx_log_error 6 "Closing failure: ${crypt_arg}"
+					fi
 					# TODO disconnect device
 					;;
 				*) ;;
 				esac
 			else
-				rwx_log_error 3 "Not a file"
+				rwx_log_error 3 "Not a file: ${crypt_file}"
 			fi
 		done
 		;;