plugin-enc
| Placement | compiled-in (in-process) |
| Source | github.com/opencharly/plugin-enc/candy/plugin-enc |
| Version | 2026.182.0001 |
| Candy | plugin-enc |
This plugin is listed in charly/charly.yml’s compiled_plugins:, so its providers are compiled into the charly binary and register in-process.
Providers
Section titled “Providers”The reserved words this plugin serves:
enc— verb class
What it does
Section titled “What it does”ENCRYPTED-VOLUME (gocryptfs) MECHANICS plugin (C16a) — runs the gocryptfs / systemd-run –scope / fusermount3 shell mechanics that mount, unmount, initialize (auto-init on charly start), and re-key charly’s gocryptfs-backed encrypted volumes. It is the security-sensitive external-command surface carved out of charly core (the former charly/enc.go is DELETED, K-wave 2). The deploy-model around it — ResolvedBindMount / ResolveVolumeBacking (sdk/deploykit/deploy_volume.go), the config loader (LoadEncryptedVolume, sdk/deploykit/enc_probe.go), the path/probe helpers, and the credential store — is sdk/deploykit + plugin-side, and the enc shim (candy/plugin-pod/enc_cmd.go) host-prelifts a self-contained per-volume plan + resolved passphrase into this plugin’s OpExecute. Compiled-in (charly config mount/unmount/passwd + charly start call the shim, which Invokes verb:enc in-proc so the passphrase never crosses a socket).
See also the candy reference for this candy’s install surface.