# enclaviaio/enclavia architecture

> Architecture diagram of the GitHub repository enclaviaio/enclavia, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/enclaviaio/enclavia
- Repository: https://github.com/enclaviaio/enclavia

## Overview

Enclavia is an auditable enclave runtime and client ecosystem. The primary user workflow is to use the CLI to manage and deploy an enclave, then connect with the Rust or WASM SDK: the SDK establishes an attestation-anchored encrypted channel through the router, and the enclave server forwards application traffic to the container. In parallel, enclave services provide outbound-network policy, encrypted persistent storage with anti-rollback checks, key management, and attested upgrade history. The README documents additional capabilities whose implementation was not sampled; those are represented only where the tree supports a source path, and uncertain wiring is omitted.

Main entry points: [`enclavia-server/src/main.rs`](https://github.com/enclaviaio/enclavia/blob/master/enclavia-server/src/main.rs) (Enclave server), [`enclavia/src/client.rs`](https://github.com/enclaviaio/enclavia/blob/master/enclavia/src/client.rs) (Rust client SDK), [`synchronizer/src/main.rs`](https://github.com/enclaviaio/enclavia/blob/master/synchronizer/src/main.rs) (Synchronizer), [`enclavia-egress/src/main.rs`](https://github.com/enclaviaio/enclavia/blob/master/enclavia-egress/src/main.rs) (Egress daemon)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["Client access"]
  node_cli["CLI commands<br/>[main.rs]"]
  node_sdk["Rust client SDK<br/>[client.rs]"]
  node_wasm["WASM bindings<br/>[lib.rs]"]
end

subgraph group_runtime["Enclave runtime"]
  node_server["Enclave server<br/>[main.rs]"]
  node_egress["Egress daemon<br/>[main.rs]"]
  node_egress_policy["Egress policy<br/>[policy.rs]"]
  node_resolver["Hostname resolver<br/>[resolver.rs]"]
end

subgraph group_storage["Storage security"]
  node_crypto["Key manager<br/>[main.rs]"]
  node_nbd["NBD storage client<br/>[main.rs]"]
end

subgraph group_trust["Attestation and trust"]
  node_protocol["Wire protocol<br/>[lib.rs]"]
  node_chain_init["Boot chain submitter<br/>[main.rs]"]
end

subgraph group_coordination["Cluster coordination"]
  node_sync["Synchronizer<br/>[main.rs]"]
  node_raft[("Raft replication<br/>[mod.rs]")]
  node_names_init["Mesh identity fetcher<br/>[main.rs]"]
end

node_user(("Enclave user"))
node_control["Hosted control plane"]
node_router["WebSocket router"]
node_workload["Container workload"]
node_egress_host["Host egress relay"]
node_kms["AWS KMS"]
node_storage_host["Host storage relay"]
node_chain_host["Host chain relay"]
node_nsm["Nitro security module"]

node_user -->|"runs commands"| node_cli
node_cli -->|"manages lifecycle"| node_control
node_user -->|"sends requests"| node_sdk
node_sdk -->|"opens WebSocket"| node_router
node_wasm -->|"binds client API"| node_sdk
node_router -->|"forwards channel"| node_server
node_server -->|"forwards plaintext"| node_workload
node_sdk -->|"uses wire types"| node_protocol
node_server -->|"uses wire types"| node_protocol
node_server -->|"requests attestation"| node_nsm
node_egress -->|"checks flows"| node_egress_policy
node_egress -->|"resolves hostnames"| node_resolver
node_egress -->|"dials over vsock"| node_egress_host
node_crypto -->|"requests key operations"| node_kms
node_crypto -->|"reads key blob"| node_storage_host
node_nbd -->|"serves block I/O"| node_storage_host
node_nbd -->|"checks and pins freshness"| node_sync
node_sync -->|"replicates volume state"| node_raft
node_sync -->|"attests mesh identity"| node_nsm
node_chain_init -->|"collects attestation"| node_nsm
node_chain_init -->|"submits chain link"| node_chain_host
node_names_init -.->|"provides routing identity"| node_sync

click node_cli "https://github.com/enclaviaio/enclavia/blob/master/enclavia-cli/src/main.rs"
click node_sdk "https://github.com/enclaviaio/enclavia/blob/master/enclavia/src/client.rs"
click node_wasm "https://github.com/enclaviaio/enclavia/blob/master/enclavia-wasm/src/lib.rs"
click node_protocol "https://github.com/enclaviaio/enclavia/blob/master/enclavia-protocol/src/lib.rs"
click node_server "https://github.com/enclaviaio/enclavia/blob/master/enclavia-server/src/main.rs"
click node_egress "https://github.com/enclaviaio/enclavia/blob/master/enclavia-egress/src/main.rs"
click node_egress_policy "https://github.com/enclaviaio/enclavia/blob/master/enclavia-egress/src/policy.rs"
click node_resolver "https://github.com/enclaviaio/enclavia/blob/master/enclavia-egress/src/resolver.rs"
click node_crypto "https://github.com/enclaviaio/enclavia/blob/master/enclavia-crypto/src/main.rs"
click node_nbd "https://github.com/enclaviaio/enclavia/blob/master/nbd-client/src/main.rs"
click node_sync "https://github.com/enclaviaio/enclavia/blob/master/synchronizer/src/main.rs"
click node_raft "https://github.com/enclaviaio/enclavia/blob/master/synchronizer/src/raft/mod.rs"
click node_chain_init "https://github.com/enclaviaio/enclavia/blob/master/enclavia-chain-init/src/main.rs"
click node_names_init "https://github.com/enclaviaio/enclavia/blob/master/synchronizer-names-init/src/main.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_sdk,node_wasm,node_user toneBlue
class node_server,node_egress,node_egress_policy,node_resolver,node_storage_host toneAmber
class node_crypto,node_nbd,node_router toneMint
class node_protocol,node_chain_init toneRose
class node_sync,node_raft,node_names_init,node_control,node_workload,node_egress_host,node_kms,node_chain_host,node_nsm toneIndigo
```

## Components

### Client access

- [CLI commands](https://github.com/enclaviaio/enclavia/blob/master/enclavia-cli/src/main.rs): `enclavia-cli/src/main.rs`
- [Rust client SDK](https://github.com/enclaviaio/enclavia/blob/master/enclavia/src/client.rs): `enclavia/src/client.rs`
- [WASM bindings](https://github.com/enclaviaio/enclavia/blob/master/enclavia-wasm/src/lib.rs): `enclavia-wasm/src/lib.rs`

### Enclave runtime

- [Enclave server](https://github.com/enclaviaio/enclavia/blob/master/enclavia-server/src/main.rs): `enclavia-server/src/main.rs`
- [Egress daemon](https://github.com/enclaviaio/enclavia/blob/master/enclavia-egress/src/main.rs): `enclavia-egress/src/main.rs`
- [Egress policy](https://github.com/enclaviaio/enclavia/blob/master/enclavia-egress/src/policy.rs): `enclavia-egress/src/policy.rs`
- [Hostname resolver](https://github.com/enclaviaio/enclavia/blob/master/enclavia-egress/src/resolver.rs): `enclavia-egress/src/resolver.rs`

### Storage security

- [Key manager](https://github.com/enclaviaio/enclavia/blob/master/enclavia-crypto/src/main.rs): `enclavia-crypto/src/main.rs`
- [NBD storage client](https://github.com/enclaviaio/enclavia/blob/master/nbd-client/src/main.rs): `nbd-client/src/main.rs`

### Attestation and trust

- [Wire protocol](https://github.com/enclaviaio/enclavia/blob/master/enclavia-protocol/src/lib.rs): `enclavia-protocol/src/lib.rs`
- [Boot chain submitter](https://github.com/enclaviaio/enclavia/blob/master/enclavia-chain-init/src/main.rs): `enclavia-chain-init/src/main.rs`

### Cluster coordination

- [Synchronizer](https://github.com/enclaviaio/enclavia/blob/master/synchronizer/src/main.rs): `synchronizer/src/main.rs`
- [Raft replication](https://github.com/enclaviaio/enclavia/blob/master/synchronizer/src/raft/mod.rs): `synchronizer/src/raft/mod.rs`
- [Mesh identity fetcher](https://github.com/enclaviaio/enclavia/blob/master/synchronizer-names-init/src/main.rs): `synchronizer-names-init/src/main.rs`

### Other components

- **Enclave user**
- **Hosted control plane**
- **WebSocket router**
- **Container workload**
- **Host egress relay**
- **AWS KMS**
- **Host storage relay**
- **Host chain relay**
- **Nitro security module**

## Connections

- Enclave user → CLI commands: runs commands
- CLI commands → Hosted control plane: manages lifecycle
- Enclave user → Rust client SDK: sends requests
- Rust client SDK → WebSocket router: opens WebSocket
- WASM bindings → Rust client SDK: binds client API
- WebSocket router → Enclave server: forwards channel
- Enclave server → Container workload: forwards plaintext
- Rust client SDK → Wire protocol: uses wire types
- Enclave server → Wire protocol: uses wire types
- Enclave server → Nitro security module: requests attestation
- Egress daemon → Egress policy: checks flows
- Egress daemon → Hostname resolver: resolves hostnames
- Egress daemon → Host egress relay: dials over vsock
- Key manager → AWS KMS: requests key operations
- Key manager → Host storage relay: reads key blob
- NBD storage client → Host storage relay: serves block I/O
- NBD storage client → Synchronizer: checks and pins freshness
- Synchronizer → Raft replication: replicates volume state
- Synchronizer → Nitro security module: attests mesh identity
- Boot chain submitter → Nitro security module: collects attestation
- Boot chain submitter → Host chain relay: submits chain link
- Mesh identity fetcher → Synchronizer: provides routing identity