@coffre/vault

coffre's vault: the keys and who holds what. It decides every read and write of a key and appends to the shared audit log as vault. It runs as a Worker beside the app's Worker, or as its own process on Node. Both use one Postgres database, each through its own restricted login:

import { postgres, vault } from '@coffre/vault/cloudflare';

export default vault((env) => ({
  database: postgres(env.VAULT_HYPERDRIVE), // coffre_vault_runtime, caching disabled
  hotDatabase: postgres(env.HOT_HYPERDRIVE), // coffre_vault_hot, for 0.15's uses
  kek: { id: env.VAULT_KEY_ID, key: env.VAULT_KEY }, // or awsKms({ keyArn, credentials }), with a signingKey
  owners: env.OWNERS.split(','), // Owners of the whole instance, whom nobody demotes while named
}));

On Node, serveVault({ socket, database, hotDatabase, … }) from @coffre/vault/node, with the vault's Postgres URLs. Only the vault's logins, coffre_vault_runtime and its hot path's, coffre_vault_hot, may write members and grants; the app uses coffre_runtime. See the deploy guide for the logins and the Hyperdrive configs.

Part of coffre, a secrets manager you deploy as a small project of your own. Its eight @coffre/* packages are released together, at one version. MIT licensed.