Open sourceAGPL-3.0self-hostedversion 1.0.2
Passwords, tokens and app settings sit in one panel on your own server.
Change a value in the browser, and your servers pull it into their
.env files on their own. The admin UI can be closed to
everyone but your addresses, and servers can only read values.
Everything people usually install a secrets vault for, and nothing extra.
Each project has its own environments, like dev, stage and prod, and
the keys inside can be sorted into folders. A .env file goes
in and out in one piece, and shared values can come from another
environment. Ctrl+K searches the whole panel, so even with a hundred
projects you find things fast.
A value is never overwritten, every edit is saved as a new version. You can see what a key held yesterday and what changed over the week, and bring back any version with one click. A deleted key comes back too.
Access is granted on a project, an environment or a folder. You can let someone see only the list of keys: a developer knows which variables an app needs but never sees production passwords. A grant can expire, and for sensitive places it can require two-factor authentication. The server checks permissions itself, so going around the UI does not help.
An edit from a junior role waits for someone more senior and does not reach the servers until then. Nobody can approve their own edit, and the owner decides which roles need approval.
The panel shows a command, you run it on the server. The agent gets an
identity of its own, and the panel keeps only a hash of it. From then on
it picks up changes, updates the .env file and restarts the
app. The agent updates itself as well, and installs only releases with
a valid signature.
A pod needs no token saved in the cluster. It shows the panel a short-lived token of its ServiceAccount, and the panel checks the signature against the cluster keys. If you already run External Secrets Operator, you can work through it.
Values come over from Infisical and Vault KV. Before the move you see what will be added and what is already there, and existing values are left alone by default. The panel does not keep the credentials of the old store.
A key can carry a note on why it exists and a date to replace it by,
and the panel reminds you in advance. You see which required keys are
missing and which ones nobody has read for a year. Environments can be
compared without showing values, and changeme in production
gets caught on its own.
Every night the panel makes an encrypted backup and tells you if it failed. Restore is one command, and upgrades take a backup first. Alerts go to Telegram or a webhook and never carry values. Once a week you get a digest of what changed.
Screenshots of a real panel with demo data: the projects, servers and addresses are made up.
The main rule: a stolen database must not give away the values. Everything else is built around it.
Every value is encrypted with AES-256-GCM using the key of its environment, and environment keys are encrypted with the root key. A value is tied to its place in the database: it cannot be moved to another environment or swapped for someone else's.
After a restart the panel is sealed, and until someone enters the root key nobody can read values, not even the owner. The key can be split into shares among several people (3 of 5 by default), entered whole, or kept as a file on the server so the panel unseals on its own.
A connected server cannot change or delete a secret: the panel simply has no such requests for servers. A test checks this on every build, so one cannot slip in by accident.
Every log entry stores the hash of the previous one, and once a day the panel checks that the chain is intact. Entries can also go straight to an external webhook, so they are not lost along with the database. The values themselves never get into the log.
For especially sensitive projects, values are encrypted right in the browser with a key the server never has. But if the project password is forgotten, the values are gone for good.
All values can be exported into one encrypted file under a password of your choice. A separate utility opens it without the panel and without a network, for the day the panel is gone.
What Sekvyr protects against, and what it does not, is covered in the security model and the threat model.
Sekvyr does not try to replace Vault entirely. It is made for the more common case: dozens of servers, a couple of people running them, and the wish to see everything in one place.
| Sekvyr | HashiCorp Vault | Infisical | |
|---|---|---|---|
| Getting started | open the panel, everything is in view | learn HCL policies, secrets engines and the terminology | a web panel, the closest to Sekvyr in spirit |
| What it needs | just Postgres | integrated Raft storage or Consul | Postgres and Redis |
| Best at | .env files, version history, delivery to servers, audit log |
dynamic secrets, PKI, encryption as a service | integrations with CI and clouds |
| License | AGPL-3.0, every feature free | BSL 1.1 | MIT, some features paid |
You need a Linux server with ports 80 and 443 free. The command installs Docker if it is missing, brings up Caddy with a Let's Encrypt certificate and starts the panel from the released images, with nightly encrypted backups from day one. At the end it prints the panel address and the owner password.
curl -fsSL https://raw.githubusercontent.com/mihsergeev/Sekvyr/main/ops/quickstart.sh | sudo shYou do not need a domain of your own: the panel opens right
away at an address like <server-ip>.sslip.io with an
ordinary certificate. Without an address list, though, the admin UI is open
to everyone, so for a permanent install pass your domain and the addresses
allowed to log in:
curl -fsSL https://raw.githubusercontent.com/mihsergeev/Sekvyr/main/ops/quickstart.sh | sudo sh -s -- --domain sekvyr.example.com --allow-ips "203.0.113.10"Log in and change the password, turn on two-factor
authentication. The installer's password sits in .env in plain text.
Create the vault. The root key shares are shown only once, hand them to different people.
Set up alerts, so you hear about it right away if something goes wrong with the panel.
Connect your first server. The panel shows a ready-made command to install the agent.
Manual install, your own HTTPS proxy, Kubernetes and backups are covered in the documentation. The released panel images are built for amd64, on other servers the installer builds the panel from source by itself.