Project
Vaultrix (securevault)
A secrets-management server in Go with encrypted storage, path-based policies, versioned secrets, audit logging, leader-follower replication, and client libraries for Go, Java, Python, and Rust.
Vaultrix is a secrets manager I built to understand the moving parts of systems like HashiCorp Vault: sealing, encryption at rest, policy, versioning, audit, and replication.
What it does
-
Seal and unseal — the master key is split with Shamir’s Secret Sharing, and the vault starts sealed after every restart.
-
Encryption at rest — AES-256-GCM for secrets, metadata, and tokens.
-
Policy-based access control — path rules with read, create, update, delete, and list capabilities, composable into multi-policy tokens.
-
Versioned secrets — every write is a new version; any version can be read back.
-
Audit logging of every operation, leader-follower replication (write to the leader, read from any node), a token-bucket rate limiter, and a built-in web UI.
-
Client libraries for Go, Java, Python, and Rust.