Struct VolumeEncryption 

pub struct VolumeEncryption {
    pub version: u8,
    pub algorithm: String,
    pub key_b64: String,
}

Wire-format request to encrypt the workload’s data volume.

The key_b64 is a 32-byte symmetric key, base64-encoded (URL-safe, no padding). Provider feeds it to cryptsetup luksFormat as a passphrase (raw bytes, no hashing on top).

algorithm is a forward-compat tag so a future schema bump can introduce e.g. xchacha20-poly1305 or hardware-attested keying without breaking existing requests. v1 supports luks2-aes-xts only; providers reject unknown algorithms with a structured UnsupportedVolumeEncryption error so old providers seeing a future-algorithm request fail loud rather than silently fall back to plain volumes.

Fields

version: u8

Schema version. v1 = LUKS2 + AES-XTS-Plain64, key supplied directly. Bump for new key-derivation flows (e.g. attested key release from a TPM / TEE).

algorithm: String

Algorithm tag. v1 only accepts luks2-aes-xts.

key_b64: String

32-byte key, base64 (URL-safe, unpadded). Consumer derives from a stable secret + workload_id so the same key recurs on respawn / standby promotion (the standby decrypts the checkpoint with it).

Implementations

impl VolumeEncryption

pub const ALGORITHM_V1: &'static str = "luks2-aes-xts"

Algorithm tag for the v1 wire format. Spelled out so callers don’t need to know the LUKS internals.

pub const VERSION_V1: u8 = 1

pub fn v1(key: [u8; 32]) -> Self

Build a v1 VolumeEncryption from a raw 32-byte key.

pub fn decoded_key(&self) -> Result<[u8; 32], Error>

Decode the base64 key back to raw bytes. Errors if the payload is malformed or the wrong length for the declared algorithm.

Trait Implementations

impl Clone for VolumeEncryption

fn clone(&self) -> VolumeEncryption

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VolumeEncryption

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VolumeEncryption

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for VolumeEncryption

fn eq(&self, other: &VolumeEncryption) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for VolumeEncryption

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for VolumeEncryption

impl StructuralPartialEq for VolumeEncryption