About this project

uBix Vault is an open-source, self-hosted secrets and encryption management system built as a lightweight alternative to HashiCorp Vault. It stores and generates secrets behind an encrypted barrier using AES-256-GCM for data at rest, with storage path bound into ciphertext. Features include Shamir k-of-n seal/unseal, token authentication with default-deny ACL policies, versioned key-value secrets (KV v2) with soft-delete capabilities, encryption-as-a-service (Transit), and dynamic MariaDB credential generation with auto-revocation. Audit logging records access with HMAC'd tokens. The system operates via a Vault-API-compatible HTTP interface and includes an operator CLI. Currently in beta (v0.2.0), it lacks external security review for production use. Documentation covers architecture, deployment, and design decisions. Built in Go with file storage backend, licensed under BSD 3-Clause.