diff --git a/src/cmd/deploy.rs b/src/cmd/deploy.rs
index 8e632f2..8901004 100644
--- a/src/cmd/deploy.rs
+++ b/src/cmd/deploy.rs
@@ -1,15 +1,66 @@
 use std::{
     collections::HashMap,
-    fs,
+    fs::{self, DirEntry, ReadDir},
+    io::ErrorKind,
     path::{Path, PathBuf},
 };
 
 use crate::profile::Profile;
 
-use eyre::Result;
-use spdlog::debug;
+use eyre::{eyre, Context, Result};
+use spdlog::{debug, error, info};
 
 impl Profile {
+    pub fn get_decrypted_mount_point_path(&self) -> String {
+        self.settings.decrypted_mount_point.to_string()
+    }
+    pub fn get_decrypt_dir_path(&self) -> String {
+        self.settings.decrypted_dir.to_string()
+    }
+    pub fn read_decrypted_mount_point(&self) -> std::io::Result<ReadDir> {
+        fs::read_dir(self.get_decrypted_mount_point_path())
+    }
+    /// init decrypted mount point and return the generation count
+    pub fn init_decrypted_mount_point(&self) -> Result<usize> {
+        let mut max = 0;
+        let b = match self.read_decrypted_mount_point() {
+            Err(e) if e.kind() == ErrorKind::NotFound => {
+                fs::create_dir_all(self.get_decrypted_mount_point_path())
+                    .wrap_err("create decrypted mountpoint error")
+            }
+            Err(e) => {
+                error!("{}", e);
+                Err(e).wrap_err(eyre!("read mountpoint error"))
+            }
+            Ok(o) => {
+                o.for_each(|en| {
+                    match str::parse::<usize>(
+                        en.unwrap()
+                            .file_name()
+                            .to_string_lossy()
+                            .to_string()
+                            .as_str(),
+                    ) {
+                        Err(e) => {
+                            error!("parse mount point generation err: {:?}", e)
+                        }
+                        Ok(res) => {
+                            info!("found mountpoint generation {}", res);
+                            if res > max {
+                                max = res;
+                            }
+                        }
+                    }
+                });
+                Ok(())
+            }
+        };
+
+        Ok(max)
+    }
+    /**
+    extract secrets to `/run/vaultix.d/$num` and link to `/run/vaultix`
+    */
     pub fn deploy(self) -> Result<()> {
         let storage_name_ctt_map: HashMap<String, Vec<u8>> = {
             let mut map = HashMap::new();
@@ -29,17 +80,10 @@ impl Profile {
             map
         };
 
-        // for entry in storage_ctt {
-        //     let entry = entry?;
-        //     let path = entry.path();
-
-        //     debug!("found renced secret in store: {:?}", path);
-        // }
-
-        let secs_map = self.get_renced_paths().into_map();
+        let secs_map = self.get_renced_store_paths().into_map();
 
         for s in secs_map.values().into_iter() {
-            debug!("found cipher file {:?}", s);
+            debug!("found cipher file {:?}", s.canonicalize()?);
         }
 
         Ok(())
diff --git a/src/cmd/renc.rs b/src/cmd/renc.rs
index 5e6194b..ebfecf9 100644
--- a/src/cmd/renc.rs
+++ b/src/cmd/renc.rs
@@ -13,7 +13,7 @@ use crate::profile::{MasterIdentity, Profile, Settings};
 use crate::{interop::add_to_store, profile};
 
 impl profile::Secret {
-    fn to_renced_pathbuf(self, settings: &Settings) -> StoredSecretPath {
+    fn to_renced_store_pathbuf(self, settings: &Settings) -> StoredSecretPath {
         StoredSecretPath::init_from(settings, &self)
     }
 }
@@ -85,12 +85,17 @@ impl Profile {
             .collect()
     }
 
-    pub fn get_renced_paths(&self) -> NamePathPairList {
+    pub fn get_renced_store_paths(&self) -> NamePathPairList {
         NamePathPairList(
             self.secrets
                 .clone()
                 .into_values()
-                .map(|i| NamePathPair(i.to_owned().id, i.to_renced_pathbuf(&self.settings).get()))
+                .map(|i| {
+                    NamePathPair(
+                        i.to_owned().id,
+                        i.to_renced_store_pathbuf(&self.settings).get(),
+                    )
+                })
                 .collect(),
         )
     }
@@ -143,7 +148,7 @@ impl Profile {
     pub fn renc(self, _all: bool, flake_root: PathBuf) -> Result<()> {
         use age::ssh;
         let cipher_contents = self.get_cipher_contents();
-        let renced_secret_paths: NamePathPairList = self.get_renced_paths();
+        let renced_secret_paths: NamePathPairList = self.get_renced_store_paths();
         debug!("secret paths: {:?}", renced_secret_paths);
 
         let mut key_pair_list = self.get_key_pair_list();