UKRRS/mopac-keyproxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1 Commit 1 Branch 0 Tags
6c88e65957a3ab361c3f9bd182d8ae8c21be9acc
T
Clone
Open with VS Code Open with VSCodium Open with Intellij IDEA
Download ZIP Download TAR.GZ Download BUNDLE

README.md

mopac-keyproxy

A key-material proxy where the vault stays authoritative. Consumers receive opaque placeholder keys; real secrets live only in Bitwarden Secrets Manager and/or HashiCorp Vault and are resolved to real material at the wire, in memory, never persisted, with no admin UI to attack.

  • Placeholders in, real keys on the wire out (mpk_... refs; a leaked placeholder is revoke-and-remap, not an incident).
  • Backends: Bitwarden Secrets Manager REST (machine accounts) and HashiCorp Vault KV v2 + AppRole. Stdlib-first; no Bitwarden SDK (license).
  • Serves as both an HTTP hop and a CLI (keyproxy get <ref> for exec-style plumbing).
  • AGPLv3. Part of the MOPAC family but standalone and composable: generic, config-driven, no organizational assumptions baked into code.

Status: specification phase (see MOPAC/harness/DESIGN.md, "Key proxy"). Building 2026-08-28 onward.

Reference in New Issue View Git Blame Copy Permalink
S
Description
Vault-authoritative key proxy: placeholders to consumers, material only in Bitwarden/Vault. Go, AGPLv3. MOPAC family, standalone-composable.
Readme AGPL-3.0
83 KiB
Languages
Go 89.1%
Shell 5.6%
Python 4.8%
Makefile 0.5%