You can mount it in two steps, and I have a script example.
Note: the service udiskctl will mount things under /media, it's more designed for desktop users mounting usb sticks.
If you want to mount the device somewhere else, it's not the solution you are looking for.
Here is what I worked out.
In this example, my encrypted device is a partition made with lvm, but this doesn't really matter. It is an ext4-formatted partition. In its encrypted form, it lives at
/dev/myvg/opt1
an encrypted partion is "opened" (decrypted) like this
STEP 1: sudo cryptsetup luksOpen /dev/myvg/opt1 opt1_opened
(this is where you enter the passphrase)
the last argument is a temporary reference to the decrypted block device.
The 'mapping' disappears when you reboot so you can choose a different name each time, if you want.
it is now visible as a device:
ls /dev/mapper
control myvg-opt1 myvg-root opt1_opened
You can mount this device: we now have an ext4 device.
To make it convenient, add a line in /etc/fstab
/dev/mapper/opt1_opened /opt1 ext4 noauto,users 0 0
and make the mount point (in my case: sudo mkdir /opt1
, and then setup permissions as you wish)
If you used the name opt1_opened in Step 1, then this is the second step to mount it:
STEP 2: mount /opt1 #the fstab line lets users mount, so no need for sudo
and it's mounted.
Hence, a bash script:
#!/bin/bash
#needs to be run sudo
read -s -p "Enter LUKS password: " luks_password
printf $luks_password | cryptsetup luksOpen /dev/myvg/opt1 opt1_opened --key-file -
sudo -u tim mount /opt1