I have a client with a security policy compliance requirement to encrypt certain files on disk. The obvious way to do this is with Device-mapper and an AES crypto module However the current system is setup to generate individual files that are encrypted.

What are my options for decrypting files on-the-fly in apache?

I see that mod_ssl and mod_session_crypto do encryption/decryption or something similar but not exactly what I am after.

I could imagine that a PerlSetOutputFilter would work with a suitable Perl script configured, and I also see mod_ext_filter so I could just fork a unix command and decrypt the file, but they both feel like a hack.

I am kind of surprised that there is no mod_crypto available...or am I missing something obvious here?

Presumably resource-wise the perl filter is the way to go?