keyraft/keyrafted repository overview

⁠Keyraft

Lightweight, self-hosted configuration and secrets management. Store config and secrets with versioning, RBAC, audit logs, and live watch — one container, no external dependencies.

Documentation: keyraft.github.io⁠ · Source: github.com/keyraft/keyrafted⁠

⁠Quick start

docker run -d -p 7200:7200 \
  -e KEYRAFT_MASTER_KEY=$(openssl rand -base64 32) \
  -v keyraft-data:/data \
  --name keyraft \
  keyraft/keyrafted:latest

The image auto-initializes on first run. Open the web UI at http://localhost:7200⁠ after you have a token.

⁠Root token

docker logs keyraft

Look for the Root token line in the output. Save it — you need it for the API and web UI.

⁠Features

• Encrypted secrets (AES-256-GCM at rest)
• Namespaced key-value store with full version history
• RBAC tokens (admin, developer, viewer, operator)
• Watch API (long-poll and SSE) for live config reloads
• HTTP/JSON API under /v1
• Built-in web UI and Prometheus metrics
• Official PHP and Dart client libraries

⁠Image tags

Also published on GitHub Container Registry: ghcr.io/keyraft/keyrafted

⁠Environment variables

⁠Volumes

Mount a volume at /data to persist the database, tokens, and audit logs across restarts:

-v keyraft-data:/data

⁠Docker Compose

services:
  keyraft:
    image: keyraft/keyrafted:latest
    ports:
      - "7200:7200"
    environment:
      KEYRAFT_MASTER_KEY: ${KEYRAFT_MASTER_KEY}
    volumes:
      - keyraft-data:/data
    restart: unless-stopped

volumes:
  keyraft-data:

Generate a master key before docker compose up:

export KEYRAFT_MASTER_KEY=$(openssl rand -base64 32)

⁠Health check

curl http://localhost:7200/v1/health

The image includes a built-in HEALTHCHECK against /v1/health.

⁠Production notes

• Always set KEYRAFT_MASTER_KEY explicitly — do not rely on auto-generated keys across redeployments
• Use a named volume or bind mount for /data
• Put a reverse proxy with TLS in front for anything exposed beyond localhost

⁠Links

• Documentation⁠
• GitHub⁠
• PHP SDK⁠
• Dart SDK⁠
• Report issues⁠

⁠License

Apache License 2.0