Keyorix: Open-source secrets management for teams that can’t use SaaS
Keyorix launched a free, open-source, self-hosted secrets manager for teams unable to use SaaS, with AES-256-GCM encryption and RBAC.
Keyorix SL released Keyorix, an open-source secrets manager shipping as a single binary that runs fully on-premises without internet, targeting air-gapped networks and European enterprises facing NIS2 and DORA compliance. It provides CLI secret injection as environment variables, Go/Python/Node.js SDKs, one-command Vault import via Docker Compose, RBAC, secret versioning, separate dev/staging/prod environments, CI/CD service tokens, and rotation-deadline alerts. All secret values are encrypted with AES-256-GCM, storage uses SQLite or PostgreSQL, and every access is logged across two audit layers.
- Single self-hosted binary, no internet required; aimed at air-gapped and NIS2/DORA-regulated environments
- AES-256-GCM encryption with passphrase-derived key-encrypting key held only in memory
- CLI injection plus Go, Python, Node.js SDKs; Vault import via one Docker Compose command
- RBAC, secret versioning, environment separation, CI/CD service tokens, rotation alerts
From the original article
1 min read at helpnetsecurity.com
Keyorix is an open-source secrets manager that runs entirely on a company’s own servers. A secrets manager is the locked store where an application fetches the database passwords, API keys, and tokens it needs, so they stay out of config files and source code. It ships as one binary and, in its core form, needs no internet connection.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.