{"id":34195955,"url":"https://github.com/zalgonoise/cloaki","last_synced_at":"2026-03-12T19:35:48.208Z","repository":{"id":65613693,"uuid":"594892652","full_name":"zalgonoise/cloaki","owner":"zalgonoise","description":"A lightweight, fast and secure web-based secrets store ","archived":false,"fork":false,"pushed_at":"2023-12-19T00:10:14.000Z","size":2079,"stargazers_count":0,"open_issues_count":4,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-12-18T18:07:55.491Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zalgonoise.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-01-29T23:44:36.000Z","updated_at":"2023-01-29T23:48:06.000Z","dependencies_parsed_at":"2024-06-20T23:13:02.515Z","dependency_job_id":"2a471149-0b2b-4124-8508-1f0ee2095d69","html_url":"https://github.com/zalgonoise/cloaki","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/zalgonoise/cloaki","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zalgonoise%2Fcloaki","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zalgonoise%2Fcloaki/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zalgonoise%2Fcloaki/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zalgonoise%2Fcloaki/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zalgonoise","download_url":"https://codeload.github.com/zalgonoise/cloaki/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zalgonoise%2Fcloaki/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30440023,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-12T14:34:45.044Z","status":"ssl_error","status_checked_at":"2026-03-12T14:09:33.793Z","response_time":114,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-12-15T17:02:46.982Z","updated_at":"2026-03-12T19:35:48.197Z","avatar_url":"https://github.com/zalgonoise.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cloaki\n\n\n*A lightweight, fast and secure web-based secrets store*\n\n\u003cp align=\"center\"\u003e\n\u003cimg style=\"text-align: center;\" display=\"block\" width=\"400\" height=\"400\" title=\"Cloaki\" src=\"https://github.com/zalgonoise/cloaki/blob/media/cloaki.png\"\u003e\n\u003c/p\u003e\n\n\n\u003cp align=\"right\"\u003e\n\u003ca href=\"https://www.instagram.com/notpiupiuken\"\u003e\n\u003cspan style=\"font-style: italic;\"\u003eCloaki artwork by @notpiupiuken\u003c/span\u003e\n\u003c/a\u003e\n\u003c/p\u003e\n\n___________\n\n## Concept\n\nCloaki is a secrets store served as a web app. It allows storing secrets (passwords and any type of confidential values) in a secure way, as a locally-deployed service (at home, in your cloud server, etc).\n\nIt supports multiple users (in accounts secured by a password defined by the user) that can share secrets among themselves, for a certain period of time. Shares will always have an expiry date, either defined by the user as a time or duration value, or one month by default.\n\nRegarding security, all secrets are encrypted with a key unique to each user, and decrypted when read. User's private keys are generated and stored in Cloaki, where the server full manages both key access and secrets encryption / decryption. User passwords are not stored in the databases, instead they are salted and hashed with a secure algorithm, where the database will store the salt and hash alone. Cloaki is not vulnerable to rainbow-table attacks.\n\nUser sessions are managed with JWT, with a signing key that can either be defined by the admin or generated by Cloaki on the first run. Issued JWT expire within one hour.\n\nCloaki uses Bolt as a key-value store for all confidential data (secrets values, JWT), and SQLite to store user, secrets and shares metadata. Bolt and SQLite data can be persisted to a file.\n\n____________\n\n## Installation\n\nTo install `cloaki` you can use Go to run it as a binary:\n\n```\ngo install github.com/zalgonoise/cloaki@latest\n```\n\n...or Docker:\n\n```\ndocker pull zalgonoise/cloaki:latest\n```\n\n____________\n\n## Configuration\n\nConfiguring the app's runtime can be done with:\n\n- CLI flags\n- OS environment variables\n- (Docker) compose file\n\n### CLI flags\n\nBelow is the list of options that can be configured as CLI flags:\n\nFlag | Type | Default value | Description\n:---:|:----:|:-------------:|:-----------:\n`-port` | `int` | `8080` | port to use for the HTTP server\n`-bolt-path` | `string` | `\"/cloaki/keys.db\"` | path to the Bolt database file\n`-sqlite-path` |  `string` | `\"/cloaki/sqlite.db\"` | path to the SQLite database file\n`-jwt-key` |  `string` | `\"/cloaki/server/key\"`  | path to the JWT signing key file\n`-logfile-path` |   `string` | `\"/cloaki/error.log\"`  | path to the logfile stored in the service\n`-tracefile-path` |  `string` | `\"/cloaki/trace.json\"`  | path to the tracefile stored in the service\n\n### OS environment variables\n\nCloaki can also be configured with OS environment variables, which will shadow the CLI flag configuration of the same kind (OS env takes precedence over CLI flags).\n\n\nVar | Type | Description\n:---:|:----:|:-----------:\n`CLOAKI_PORT` | `int` | port to use for the HTTP server\n`CLOAKI_BOLT_PATH` | `string` | path to the Bolt database file\n`CLOAKI_SQLITE_PATH` |  `string` | path to the SQLite database file\n`CLOAKI_JWT_KEY_PATH` |  `string` | path to the JWT signing key file\n`CLOAKI_LOGFILE_PATH` | `string` | path to the logfile stored in the service\n`CLOAKI_TRACEFILE_PATH` | `string` | path to the tracefile stored in the service\n\n### Docker compose\n\nThe `docker-compose.yaml` allows for the admin to configure the service's exposed HTTP port and to define a volume (for example, a Docker volume or a folder) to persist the container's data:\n\n```yaml\n    ports: \n      - 8080:8080\n    volumes:\n      - /tmp/cloaki:/cloaki\n```\n\n________\n\n\n## Endpoints\n\nTo interact with Cloaki, you can use the HTTP API directly. Plans for a CLI client and a Flutter app in the future.\n\n### Users \n\nAuth | Path | Method | Description | Post data\n:---:|:---:|:------:|:-----------:|:---------:\nN | `/users/` | `POST` | Creates a user | `{\"username\":\"myUser\",\"name\":\"User\",\"password\":\"mySecretPassword\"}`\nY | `/users/` | `GET` | Lists all users |\nY | `/users/{username}` | `GET` | Fetches the user |\nY | `/users/{username}` | `PUT` | Updates the user('s name) | `{\"name\":\"NewName\"}`\nY | `/users/{username}` | `DELETE` | Deletes the user |\n\n### Secrets\n\nAuth | Path | Method | Description | Post data\n:---:|:---:|:------:|:-----------:|:---------:\nY | `/secrets/` | `GET` | Lists all secrets owned and shared with the user |\nY | `/secrets/` | `POST` | Creates a new secret | `{\"key\":\"mySecret\",\"value\":\"myValue\"}`\nY | `/secrets/{key}` | `GET` | Fetches the secret |\nY | `/secrets/{key}` | `DELETE` | Deletes the secret |\n\n### Shares\n\n\nAuth | Path | Method | Description | Post data\n:---:|:---:|:------:|:-----------:|:---------:\nY | `/secrets/{key}/share` | `POST` | Shares the secret with other users. May include a duration (`dur` field) or a time (`time` field) | `{\"targets\":[\"otherUser\",\"myFriend\"]}`\nY | `/shares/` | `GET` | Lists all secrets that the user has shared with other users |\nY | `/shares/{key}` | `GET` | Fetches the secret's share metadata |\nY | `/shares/{key}` | `DELETE` | Unshares the secret, optionally specifying the users to remove (otherwise unsharing with all users) | `{\"targets\":[\"otherUser\"]}`\n\n### Sessions\n\n\nAuth | Path | Method | Description | Post data\n:---:|:---:|:------:|:-----------:|:---------:\nN | `/login` | `POST` | Sign in action which returns a new JWT if successful | `{\"username\":\"myUser\",\"password\":\"mySecretPassword\"}`\nY | `/logout` | `POST` | Terminate the user's active sesion (invalidates the JWT) | \nY | `/recover` | `POST` | Updates a user's password. Requires the previous password. | `{\"password\":\"mySecretPassword\",\"new_password\":\"myNewSecretPassword\"}`\nY | `/refresh` | `POST` | Refreshes the user's JWT | `{\"username\":\"myUser\"}`\n\n\n___________\n\n## How it was made\n\nSee the entire process of [designing, writing and building Cloaki](https://github.com/zalgonoise/research/blob/master/ddd/index.md)!\n\n___________\n\n\n## Contributing\n\nThere are a ton of features (and flaws, surely!) that deserve the attention, despite this being a cozy, home-focused, local deployment type of project. \n\nYou can suggest changes by opening an issue or to contribute directly with a PR. All input is welcome!","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzalgonoise%2Fcloaki","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzalgonoise%2Fcloaki","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzalgonoise%2Fcloaki/lists"}