Skip to main content

e2ee

e2ee — ɳSelf documentation.

E2EE Plugin

End-to-end encryption key management. Client-side key exchange, server-stored encrypted blobs, Signal-protocol compatible. Free: MIT licensed. Always free per Security-Always-Free Doctrine.

Install

nself plugin install e2ee

What It Does

Manages end-to-end encryption key material for your applications. The server never sees plaintext — it stores opaque encrypted blobs and mediates key exchange between clients using Signal-protocol-compatible primitives (X3DH for initial key agreement, Double Ratchet for session keys).

Key operations:

  • Publish identity keys and one-time prekeys to the server key store
  • Fetch prekey bundles for other users to initiate encrypted sessions
  • Store and retrieve encrypted message blobs (ciphertext only, no plaintext)
  • Key revocation and device management

This plugin is designed to work alongside the chat and notifications plugins for encrypted messaging, but it is standalone and can back any client-side encryption scheme.

Configuration

Env VarDefaultDescription
E2EE_MAX_PREKEYS100Maximum one-time prekeys per user
E2EE_KEY_TTL_DAYS30Days before unused prekeys are pruned

Ports

No fixed external port. The E2EE service is proxied through Nginx.

Database Tables

3 tables added to your Postgres database:

  • np_e2ee_identity_keys: user identity and signed prekey bundles
  • np_e2ee_prekeys: one-time prekeys (consumed on use)
  • np_e2ee_blobs: server-stored encrypted blobs

Nginx Routes

MethodPathPurpose
GET/e2ee/keys/:userIdFetch prekey bundle for a user
POST/e2ee/keysPublish identity key + prekeys
DELETE/e2ee/keys/:keyIdRevoke a key
POST/e2ee/blobsStore an encrypted blob
GET/e2ee/blobs/:idRetrieve an encrypted blob

Security Doctrine

This plugin is always free per the Security-Always-Free Doctrine. Encryption key management is never paywalled.

Source