Also, I’ve unintentionally made an encrypted version of ix-apps on a system by using zfs send/receive with the -x encryption flag to migrate into an newly encrypted pool (which makes any received datasets inherit encryption de-facto.)
This was done on 24.10 and survived the update to 25.04 fine, the only side-effect I can see is that there are a bunch of newly made datasets in ix-apps/app_mounts that still get created unencrypted. these are all for the catalogue apps using host-paths so they are all empty, incidentally enough.
the dataset is inheriting encryption from the main pool, automatically unlocked.
NAME PROPERTY VALUE SOURCE
Reality/ix-apps encryption aes-256-gcm -
however some datasets in app_mounts are not…
NAME PROPERTY VALUE SOURCE
Reality/ix-apps/app_mounts/wordpress/mariadbData encryption off default
Even though the dataset is empty (the app is and always has been using host-path for the database)
NAME USED AVAIL REFER MOUNTPOINT
Reality/ix-apps/app_mounts/wordpress/mariadbData 96K 2.38T 96K /mnt/.ix-apps/app_mounts/wordpress/mariadbData