Initial implementation of arca, a LUKS volume manager.

Go CLI using cobra with mount, unmount, status, and init subcommands.
Unlocks via udisks2 D-Bus (passphrase/keyfile) or cryptsetup (FIDO2/TPM2)
with ordered method fallback. Includes NixOS-specific LD_LIBRARY_PATH
injection for systemd cryptsetup token plugins.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mount.go

@@ -0,0 +1,75 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"git.wntrmute.dev/kyle/arca/internal/config"
+	"git.wntrmute.dev/kyle/arca/internal/cryptsetup"
+	"git.wntrmute.dev/kyle/arca/internal/udisks"
+	"git.wntrmute.dev/kyle/arca/internal/unlock"
+	"github.com/spf13/cobra"
+	"golang.org/x/term"
+)
+
+var mountCmd = &cobra.Command{
+	Use:   "mount <device|alias>",
+	Short: "Unlock and mount a LUKS volume",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runMount,
+}
+
+func init() {
+	rootCmd.AddCommand(mountCmd)
+}
+
+func runMount(cmd *cobra.Command, args []string) error {
+	cfg := config.Load()
+	target := args[0]
+
+	client, err := udisks.NewClient()
+	if err != nil {
+		return fmt.Errorf("connecting to udisks2: %w", err)
+	}
+	defer client.Close()
+
+	devCfg := cfg.ResolveDevice(target)
+
+	dev, err := client.FindDevice(devCfg.UUID, target)
+	if err != nil {
+		return err
+	}
+
+	u := unlock.New(client, unlock.Options{
+		ReadPassphrase: readPassphrase,
+		KeyfilePath:    devCfg.Keyfile,
+	})
+
+	result, err := u.Unlock(dev, devCfg.Methods)
+	if err != nil {
+		return err
+	}
+
+	var mountpoint string
+	if result.Privileged {
+		mountpoint, err = cryptsetup.Mount(result.Device.DevicePath, devCfg.Mountpoint)
+	} else {
+		mountpoint, err = client.Mount(result.Device)
+	}
+	if err != nil {
+		return fmt.Errorf("mounting: %w", err)
+	}
+
+	fmt.Println(mountpoint)
+	return nil
+}
+
+func readPassphrase() (string, error) {
+	fmt.Fprint(os.Stderr, "Passphrase: ")
+	pass, err := term.ReadPassword(int(os.Stdin.Fd()))
+	fmt.Fprintln(os.Stderr)
+	if err != nil {
+		return "", fmt.Errorf("reading passphrase: %w", err)
+	}
+	return string(pass), nil
+}