plugin-enc
| Version | 2026.182.0001 |
| Repo | superproject |
| Plugin | yes — see the plugin reference |
ENCRYPTED-VOLUME (gocryptfs) MECHANICS plugin (C16a) — runs the gocryptfs / systemd-run –scope / fusermount3 shell mechanics that mount, unmount, initialize (auto-init on charly start), and re-key charly’s gocryptfs-backed encrypted volumes. It is the security-sensitive external-command surface carved out of charly core (charly/enc.go). charly keeps the deploy-model around it — ResolvedBindMount / ResolveVolumeBacking, the config loader, the path/probe helpers (which the mandatorily-core ResolveVolumeBacking + verifyBindMounts consume), and the credential store — and its in-core enc shim host-prelifts a self-contained per-volume plan + resolved passphrase into this plugin’s OpExecute. Compiled-in (charly config mount/unmount/passwd + charly start call the shim, which Invokes verb:enc in-proc so the passphrase never crosses a socket).
Acceptance plan
Section titled “Acceptance plan”This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.
| Intent | Step |
|---|---|
check |
the encrypted-volume mechanics plugin ships a buildable Go module the host compiles in |