Skip to main content

e2ee

e2ee — ɳSelf documentation.

E2EE Plugin

End-to-end encryption key management. Client-side key exchange, server-stored encrypted blobs, Signal-protocol compatible. Free: MIT licensed. Always free per Security-Always-Free Doctrine.

Install

nself plugin install e2ee

What It Does

Manages end-to-end encryption key material for your applications. The server never sees plaintext, it stores opaque encrypted blobs and mediates key exchange between clients using Signal-protocol-compatible primitives (X3DH for initial key agreement, Double Ratchet for session keys).

Key operations:

  • Publish identity keys and one-time prekeys to the server key store
  • Fetch prekey bundles for other users to initiate encrypted sessions
  • Store and retrieve encrypted message blobs (ciphertext only, no plaintext)
  • Key revocation and device management

This plugin is designed to work alongside the chat and notifications plugins for encrypted messaging, but it is standalone and can back any client-side encryption scheme.

Configuration

Env Var Default Description
E2EE_MAX_PREKEYS 100 Maximum one-time prekeys per user
E2EE_KEY_TTL_DAYS 30 Days before unused prekeys are pruned

Ports

No fixed external port. The E2EE service is proxied through Nginx.

Database Tables

3 tables added to your Postgres database:

  • np_e2ee_identity_keys: user identity and signed prekey bundles
  • np_e2ee_prekeys: one-time prekeys (consumed on use)
  • np_e2ee_blobs: server-stored encrypted blobs

Nginx Routes

Method Path Purpose
GET /e2ee/keys/:userId Fetch prekey bundle for a user
POST /e2ee/keys Publish identity key + prekeys
DELETE /e2ee/keys/:keyId Revoke a key
POST /e2ee/blobs Store an encrypted blob
GET /e2ee/blobs/:id Retrieve an encrypted blob

Security Doctrine

This plugin is always free per the Security-Always-Free Doctrine. Encryption key management is never paywalled.

Source