e2ee

E2EE Plugin

End-to-end encryption key management. Client-side key exchange, server-stored encrypted blobs, Signal-protocol compatible. Free: MIT licensed. Always free per Security-Always-Free Doctrine.

Install

nself plugin install e2ee

What It Does

Manages end-to-end encryption key material for your applications. The server never sees plaintext — it stores opaque encrypted blobs and mediates key exchange between clients using Signal-protocol-compatible primitives (X3DH for initial key agreement, Double Ratchet for session keys).

Key operations:

• Publish identity keys and one-time prekeys to the server key store
• Fetch prekey bundles for other users to initiate encrypted sessions
• Store and retrieve encrypted message blobs (ciphertext only, no plaintext)
• Key revocation and device management

This plugin is designed to work alongside the chat and notifications plugins for encrypted messaging, but it is standalone and can back any client-side encryption scheme.

Configuration

Env Var	Default	Description
E2EE_MAX_PREKEYS	100	Maximum one-time prekeys per user
E2EE_KEY_TTL_DAYS	30	Days before unused prekeys are pruned

Ports

No fixed external port. The E2EE service is proxied through Nginx.

Database Tables

3 tables added to your Postgres database:

• np_e2ee_identity_keys: user identity and signed prekey bundles
• np_e2ee_prekeys: one-time prekeys (consumed on use)
• np_e2ee_blobs: server-stored encrypted blobs

Nginx Routes

Method	Path	Purpose
GET	/e2ee/keys/:userId	Fetch prekey bundle for a user
POST	/e2ee/keys	Publish identity key + prekeys
DELETE	/e2ee/keys/:keyId	Revoke a key
POST	/e2ee/blobs	Store an encrypted blob
GET	/e2ee/blobs/:id	Retrieve an encrypted blob

Security Doctrine

This plugin is always free per the Security-Always-Free Doctrine. Encryption key management is never paywalled.

Source

• SPORT: .claude/docs/sport/F03-PLUGIN-INVENTORY-FREE.md
• See also: Security Hardening · Audit Log Plugin