Project
Foostash
An encrypted, versioned secrets and environment manager with a Go CLI and self-hostable server.
Secrets should be versioned, shared carefully, and boring to operate.
What it is
Foostash is an encrypted secrets and environment manager. It is a single-binary Go CLI backed by a self-hostable HTTP server, authenticated with SSH keys, and designed to replace loose .env files, shared credentials in chat, and password-filled wiki pages.
The main constraint is simple: the server should not need plaintext secrets. Secret values are encrypted locally with a master key using AES-256-GCM, then stored through the server as encrypted data.
How it works
Foostash has two parts: a local CLI and a server. The CLI handles developer workflows like initialization, setting values, and running commands with a selected environment. The server handles organizations, users, projects, environments, invites, and audit data.
Authentication uses SSH keys instead of passwords. Your existing ~/.ssh/id_ed25519 can become the credential, which keeps the flow close to how developers already identify themselves on machines.
What it supports
- Local encryption with a master key.
- SSH-signed authentication.
- Self-hosting with Docker Compose.
- Organizations, admin and developer roles, invite tokens, projects, and environments.
- Running commands with injected environment values.
- PostgreSQL-backed server state.
Quick shape
docker compose up -d
foostash register --server http://localhost:8400 --email you@example.com --org "Acme"
foostash init --project myapp
foostash set DB_HOST=localhost DB_PORT=5432 --env dev
foostash run --env dev -- go run ./cmd/serverWhat I focused on
Foostash is about making a sensitive workflow safer without making it feel heavy. The product line is security, but the engineering challenge is developer experience: local-first encryption, clear command design, self-hosting, and a server model that supports teams without turning secrets into plain text server data.