Engineers and security teams who cannot send credentials to a cloud service now have a self-hosted option that fits in a single binary and needs no internet connection. Keyorix is an open-source secrets manager built for air-gapped networks and European enterprises that have to line up with NIS2 and DORA, the EU’s security and financial-resilience rules. Every secret value is encrypted with AES-256-GCM, access is logged across two audit layers, and a web dashboard handles day-to-day work.<\/p>\n
A secrets manager is the locked store where an application fetches the database passwords, API keys, and tokens it needs, so they stay out of config files and source code. Keyorix is the open-source answer for teams that cannot point that store at a SaaS vendor.<\/p>\n
The company behind it positions the tool for two main cases: air-gapped networks that cannot reach a cloud service, and European enterprises that need to align with NIS2 and DORA. Its own comparison table sets Keyorix against two alternatives: Vault, which runs on premises but requires a dedicated admin, and Doppler, which is simple but SaaS-only. Keyorix sits in the middle, on premises, with no dedicated admin role required.<\/p>\n
Two delivery paths are offered. A command-line tool injects secrets as environment variables, so the application reads them like ordinary settings. Native SDKs are available for Go, Python, and Node.js for teams that want to call the store from inside the code.<\/p>\n
Migration is built in. Teams already running Vault can import what they have, and the full stack, web interface included, starts with one Docker Compose command. That low-friction start is part of the pitch to small teams that do not want a dedicated secrets administrator.<\/p>\n
Around the core engine sit the controls a security team expects:<\/p>\n
Every access is logged with who, what, when, and from where, across two audit layers. For regulated environments, that two-layer trail is the line item that maps to NIS2 logging expectations and DORA incident-response records.<\/p>\n
The cryptographic design is straightforward and worth understanding for compliance reviews. Each secret value is encrypted with AES-256-GCM. A passphrase is set at startup and stretched into a key-encrypting key that lives only in memory. That key wraps the data key, which in turn wraps the stored secrets. Keeping the key-encrypting key in RAM and never on disk is what lets the system run on hardware that may be seized or imaged.<\/p>\n
Storage is split by scale. SQLite backs development setups and small teams. PostgreSQL is the backend for production deployments where the audit and versioning features generate heavier write traffic.<\/p>\n
Keyorix is available for free on GitHub under the project’s own organisation. The repository includes the single binary, the Docker Compose stack, and the SDKs for Go, Python, and Node.js. Because it is open source, teams in regulated environments can audit the code themselves before deploying it, which is often a hard requirement under NIS2 procurement rules.<\/p>\n
Keyorix is an open-source secrets manager that runs entirely on a company’s own servers. It ships as one binary, needs no internet connection in its core form, and encrypts every secret with AES-256-GCM.<\/p>\n
It targets teams that cannot send credentials to a cloud service, including air-gapped networks and European enterprises aligning with NIS2 and DORA, the EU’s security and financial-resilience rules.<\/p>\n
A command-line tool injects secrets as environment variables, and native SDKs are available for Go, Python, and Node.js. Teams already on Vault can import their existing data, and one Docker Compose command starts the full stack.<\/p>\n