Enclavr documentation

Enclavr turns one validated namespace into an ordered plan for one exact host. OpenBao is the only supported configuration and secret store. Hosts use accepted scoped connections; attended cluster administration uses protected operator-owned custody. External backups are managed manually outside Enclavr.

Open the documentation map full size

Choose your path

• Preparing a new machine? Start with Prepare a host, then Plan, deploy, and verify.
• Build or deployment failing? Check Repository environment and authentication for the exact .env requirements, provider selection, and separate build diagnostics.
• Caddy publication rejected? Use Caddy publication troubleshooting to check the Caddyfile and use the preparation/publication forms. Unrelated asset edits require no republication.
• Trying to understand the system? Read Control-plane architecture, Namespace model, and Secret-store boundaries.
• Changing protected configuration? Use Edit private data safely. For a proxy or site change, continue with Update a Caddy mask.
• Moving namespace-writing responsibility? Follow Move the namespace writer for a coordinated handover and recovery plan.
• Operating OpenBao? Start with paths, roles and custody, then use the initialization and recovery runbook and isolated restore exercise.
• DNS fetch blocked by a stale rollback? Use DNS checkpoint recovery to preserve the checkpoint and accept the existing approved source.
• Looking for a command? Use the Command map and the command's built-in --help output.

The six layers

1. Orientation explains what Enclavr controls and directs each reader to the right path.
2. Getting started takes a host from prerequisites to a verified, repeatable deployment.
3. Architecture defines authority, data flow, scoped identities, and operator custody.
4. Operations covers safe changes, deployment, verification, and recovery boundaries.
5. Troubleshooting connects recognizable errors with their causes, recovery steps, and acceptance checks.
6. Reference provides the command hierarchy and links to authoritative upstream product documentation.

Safety boundary

This site publishes reviewed operating guidance only. It contains no live inventory, connection file, AppRole credential, service-account token, recovery material, namespace document, or generated Caddyfile. Never paste protected values into commands, tickets, documentation, or logs.