Keyorix, an open-source secrets management solution, has been released, offering an on-premises alternative for organizations unable to utilize cloud-based services for credential storage. The system is designed to run entirely on a company's own infrastructure, with its core functionality requiring no internet connection.
The company behind Keyorix, Keyorix SL, highlights its suitability for environments such as air-gapped networks and European enterprises that must comply with regulations like NIS2 and DORA. The product aims to address a gap between complex on-premises solutions requiring dedicated administrators and simpler, but SaaS-only, alternatives.
Secrets, such as database passwords, API keys, and tokens, are managed by Keyorix to prevent their exposure in configuration files or source code. Developers can integrate these secrets into applications via a command-line tool that injects them as environment variables, or through SDKs provided for Go, Python, and Node.js. Existing users of other secrets managers, such as Vault, can import their current configurations into Keyorix.
The full Keyorix stack, including a web interface, can be deployed with a single Docker Compose command. The system incorporates robust access controls, including role-based access control and group permissions. It also features secret versioning, supports separate development, staging, and production environments, and provides service tokens for CI/CD pipelines. A web dashboard offers a graphical interface for team management, and alerts are provided for secrets approaching their rotation deadlines.
Underneath, Keyorix encrypts all secret values using AES-256-GCM. A passphrase established at startup is used to derive a key-encrypting key, which resides solely in memory and is used to wrap the data key. For data storage, Keyorix uses SQLite for development and smaller teams, while PostgreSQL is recommended for production environments. The system maintains comprehensive audit logs, recording who accessed what, when, and from where, across two distinct audit layers.
Keyorix is available for free on GitHub.
