Initial implementation of arca, a LUKS volume manager.

Go CLI using cobra with mount, unmount, status, and init subcommands.
Unlocks via udisks2 D-Bus (passphrase/keyfile) or cryptsetup (FIDO2/TPM2)
with ordered method fallback. Includes NixOS-specific LD_LIBRARY_PATH
injection for systemd cryptsetup token plugins.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/unmount.go

@@ -0,0 +1,73 @@
+package cmd
+
+import (
+	"fmt"
+	"strings"
+
+	"git.wntrmute.dev/kyle/arca/internal/config"
+	"git.wntrmute.dev/kyle/arca/internal/cryptsetup"
+	"git.wntrmute.dev/kyle/arca/internal/udisks"
+	"github.com/spf13/cobra"
+)
+
+var unmountCmd = &cobra.Command{
+	Use:     "unmount <device|alias>",
+	Aliases: []string{"umount"},
+	Short:   "Unmount and lock a LUKS volume",
+	Args:    cobra.ExactArgs(1),
+	RunE:    runUnmount,
+}
+
+func init() {
+	rootCmd.AddCommand(unmountCmd)
+}
+
+func runUnmount(cmd *cobra.Command, args []string) error {
+	cfg := config.Load()
+	target := args[0]
+
+	client, err := udisks.NewClient()
+	if err != nil {
+		return fmt.Errorf("connecting to udisks2: %w", err)
+	}
+	defer client.Close()
+
+	devCfg := cfg.ResolveDevice(target)
+
+	dev, err := client.FindDevice(devCfg.UUID, target)
+	if err != nil {
+		return err
+	}
+
+	cleartext, err := client.CleartextDevice(dev)
+	if err != nil {
+		return fmt.Errorf("finding cleartext device: %w", err)
+	}
+
+	// Unmount: try udisks2 first, fall back to privileged umount.
+	mp, _ := client.MountPoint(cleartext)
+	if err := client.Unmount(cleartext); err != nil {
+		if mp == "" {
+			return fmt.Errorf("unmounting: %w", err)
+		}
+		if err := cryptsetup.Unmount(mp); err != nil {
+			return fmt.Errorf("unmounting: %w", err)
+		}
+	}
+
+	// Lock: try udisks2 first, fall back to cryptsetup close if it's
+	// an arca-managed mapping.
+	if err := client.Lock(dev); err != nil {
+		mapperName := cryptsetup.MapperName(dev.DevicePath)
+		if strings.HasPrefix(mapperName, "arca-") {
+			if err := cryptsetup.Close(mapperName); err != nil {
+				return fmt.Errorf("locking: %w", err)
+			}
+		} else {
+			return fmt.Errorf("locking: %w", err)
+		}
+	}
+
+	fmt.Printf("Unmounted and locked %s\n", target)
+	return nil
+}