tessaridb/vault repository overview

⁠TessariDB Vault

A password manager for companies, with every record encrypted in the browser and every piece of state in TessariDB.

Companies, departments and teams share passwords, keys, notes and small files as end-to-end encrypted records. The server and the database store and move ciphertext; neither holds a key that opens a record. One Rust binary serves the API and the web application; nothing of the database is inside this image.

• Site: https://vault.tessaridb.com⁠
• Documentation: https://docs.tessaridb.com/vault⁠
• Source: https://github.com/tessaridb/tessaridb-vault⁠

⁠Tags

The configuration and the HTTP surface may still change in a minor release before 1.0. Pin a version tag.

⁠What it needs

• A TessariDB node, 0.39.3 or later (0.39.4 is withdrawn), and an account on it that may edit one namespace. The server never signs in as the store's owner. Without TESSARIDB_VAULT_STORE_AUTHORITY it reaches a store only on loopback, which is why the Compose example runs it in the node's network namespace.
• The service key file: 32 random bytes as 64 hexadecimal characters, readable by the user 65532 alone. It derives every company's vault key. It is not in the store, so back it up apart from the store's backups.
• An https address in front of it (TESSARIDB_VAULT_PUBLIC_URL) before anyone else reaches it; passkeys need it.

⁠Port

The listener speaks plain HTTP for a TLS terminator in front of it.

⁠With a TessariDB node, in Compose

The repository's compose.yaml starts the node, declares the server's account (docker/vault-account.sh), writes the service key into a volume of its own (docker/service-key.sh) and starts the server:

git clone https://github.com/tessaridb/tessaridb-vault && cd tessaridb-vault && git checkout v0.0.1
cp .env.example .env    # set TESSARIDB_PASSWORD, VAULT_STORE_PASSWORD and the platform admin
docker compose up -d --wait
docker compose run --rm vault enrolment-link

enrolment-link prints a single-use enrolment token for the platform admin, valid for 24 hours; open http://localhost:8080/#/join and paste it.

⁠Variables

The server refuses to start, naming the variable, when a value it needs is missing. The image carries no credential.

⁠Health and stopping

The image's health check runs tessaridb-vault health, which asks the server in the container whether it answers and exits 0 when it does, so docker compose up --wait returns once the server serves. The server finishes the requests in flight on SIGTERM. It runs as the non-root user 65532 on a distroless base.

⁠Licence

Business Source License 1.1. Production use is free, commercial use included. A commercial licence is needed only to provide it to third parties as a hosted or managed service for their passwords and secrets, or to sell it. Each version converts to the Apache License 2.0 on its Change Date. [email protected]⁠