{"id":50895207,"url":"https://github.com/flexdinesh/key-keeper","last_synced_at":"2026-06-15T23:31:28.579Z","repository":{"id":346779312,"uuid":"1191555950","full_name":"flexdinesh/key-keeper","owner":"flexdinesh","description":"Simple auth gateway to be used with Caddy forward_auth","archived":false,"fork":false,"pushed_at":"2026-03-26T10:42:21.000Z","size":29,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-26T14:00:39.922Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/flexdinesh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-03-25T11:09:18.000Z","updated_at":"2026-03-26T10:42:25.000Z","dependencies_parsed_at":"2026-03-26T14:00:57.065Z","dependency_job_id":null,"html_url":"https://github.com/flexdinesh/key-keeper","commit_stats":null,"previous_names":["flexdinesh/key-keeper"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/flexdinesh/key-keeper","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flexdinesh%2Fkey-keeper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flexdinesh%2Fkey-keeper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flexdinesh%2Fkey-keeper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flexdinesh%2Fkey-keeper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/flexdinesh","download_url":"https://codeload.github.com/flexdinesh/key-keeper/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flexdinesh%2Fkey-keeper/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34385031,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-15T02:00:07.085Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-15T23:31:26.201Z","updated_at":"2026-06-15T23:31:28.566Z","avatar_url":"https://github.com/flexdinesh.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# key-keeper\n\n`key-keeper` is a super lightweight auth gateway for API key validation.\nIt is built to sit beside a reverse proxy like Caddy and decide auth before traffic reaches your upstream.\n\n## Where it works best\n\n- Config-driven rules and keys loaded once at startup.\n- YAML config only. No database.\n- Rules and keys stay in memory.\n- No dynamic config or key updates during runtime. Restart to apply changes.\n- Built for Caddy `forward_auth`, but works with any server that forwards the original host and URI.\n\n## Behavior\n\n- `200` when auth succeeds.\n- `401` when a required header is missing.\n- `403` when the header value is wrong.\n- `403` when no rule matches. Deny by default.\n\n## Configuration\n\nConfig values can use `${ENV_VAR}` placeholders. `rules[].validators[].value` must be base64 input. `key-keeper` resolves `${ENV_VAR}` first, then base64-decodes the final value during config load.\n\n```yaml\nserver:\n  listen_addr: \":8181\"\n  shutdown_timeout: 5s\n  access_log:\n    format: json\n\nrules:\n  - name: otel-http-traces\n    host:\n      type: exact\n      value: ingest-http.example.com\n    paths:\n      - type: prefix\n        value: /v1\n    validators:\n      - type: header_exact\n        header: x-api-key\n        # actual value from OTEL_INGEST_API_KEY_BASE64: change-me\n        value: ${OTEL_INGEST_API_KEY_BASE64}\n```\n\nSet `KEY_KEEPER_CONFIG` if you want another path. If unset, the binary default is `config/config.yaml`. The container image sets `KEY_KEEPER_CONFIG=/app/config/config.yaml` but does not include a config there, so mount your config file to `/app/config/config.yaml` or point `KEY_KEEPER_CONFIG` at another mounted path. Container startup fails if no config file is mounted.\n\nFor the full config contract, see `docs/configuration.md`.\n\n## Examples\n\n### Docker Compose with Caddy\n\n`docker-compose.yml`\n\n```yaml\nservices:\n  key-keeper:\n    image: ghcr.io/flexdinesh/key-keeper:latest\n    environment:\n      # actual value: change-me\n      OTEL_INGEST_API_KEY_BASE64: Y2hhbmdlLW1l\n    volumes:\n      - ./config.yaml:/app/config/config.yaml:ro\n    expose:\n      - \"8181\"\n\n  caddy:\n    image: caddy:2.10\n    depends_on:\n      - key-keeper\n    ports:\n      - \"80:80\"\n      - \"443:443\"\n    volumes:\n      - ./Caddyfile:/etc/caddy/Caddyfile:ro\n      - caddy_data:/data\n      - caddy_config:/config\n\nvolumes:\n  caddy_data:\n  caddy_config:\n```\n\n`Caddyfile`\n\n```caddy\n{\n\tauto_https disable_redirects\n}\n\ningest-grpc.example.com {\n\tforward_auth key-keeper:8181 {\n\t\turi /auth\n\t}\n\n\treverse_proxy otel-backend:4317\n}\n\ningest-http.example.com {\n\tforward_auth key-keeper:8181 {\n\t\turi /auth\n\t}\n\n\treverse_proxy otel-backend:4318\n}\n```\n\nCopy `examples/with-caddy/config.yaml`, change hosts, paths, and keys, then mount it as `./config.yaml`. Replace `otel-backend` with your actual upstream service. Runnable refs: `examples/with-caddy/compose.yml`, `examples/with-caddy/Caddyfile`, `examples/with-caddy/config.yaml`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflexdinesh%2Fkey-keeper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fflexdinesh%2Fkey-keeper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflexdinesh%2Fkey-keeper/lists"}