open source · MITv0.4.13single Go binary

Secrets that never leave your machine unencrypted.

Encrypted, versioned secrets and environment manager. SSH-key auth, a self-hostable server, and zero knowledge by design — the server never sees plaintext. Retire your .env files and Slack-pasted credentials.

brew install Omotolani98/foostash/foostash

→ self-host in one command → read the docs

~/myapp

What you get

zero-knowledgeSecret values are encrypted locally with your master key. The server stores ciphertext and metadata — it can never read a value.

ssh-key authNo passwords, no tokens to rotate. Your existing ~/.ssh/id_ed25519 signs every request; the server verifies your fingerprint.

self-hostableOne docker compose up -d gets you a running server and Postgres. No cloud dependency, ever.

versioned + rollbackEvery write is a version. foostash history shows who changed what; foostash rollback restores any prior value.

deploy targetsRender secrets straight into Docker env files, Kubernetes Secrets, or GitHub Actions — no copy-paste step.

team-readyOrgs, admin and developer roles, invite tokens, and a queryable audit log of every action.

Architecture

One CLI, one server, one Postgres. Nothing else to run.

foostash CLIyour laptop / CImaster.key · AES-256-GCM
plaintext lives only here

foostash serveself-hosted · one containerorgs · users · invites
audit log · SSH pubkeys

Postgresyours, anywhereno secret values
no private keys

Security model

Short enough to actually read. The full model is in docs/security.md.

cryptoAES-256-GCM for local secret files and export bundles. A random 12-byte nonce per write; authenticated ciphertext rejects tampering.

master key32 bytes at ~/.foostash/master.key (mode 0600) or via FOOSTASH_MASTER_KEY. Losing it means losing local data — there is deliberately no recovery path.

wire authEvery request is signed with your SSH private key and verified against your registered public key. Timestamp header gives ±5 min replay protection.

serverHolds org, user, project, env, invite, and audit metadata plus SSH public keys. Never secret values, never private keys.

revocationadmin users revoke flips revoked_at on the user row; every subsequent SSH-signed request from that key fails auth.

Self-host in three steps

Your server, your Postgres, your keys. No cloud dependency, no pricing page.

1 · run the server

$ docker compose up -d
# server + Postgres, done

2 · register your org

$ foostash register \
  --server http://localhost:8400 \
  --email you@example.com \
  --org "Acme"

3 · invite the team

$ foostash admin invite
# they run: foostash join <token>