Keyward Server

Where things stand. Keyward Server 1.0.0-alpha.1 is the first build. It runs on an internal staging instance with empty data, for development and testing, and is not open to the public. The status page says what is proven and what is not.

What it is

Keyward Server holds the things a team must never paste into chat, into a pipeline variable or into a file in a repository: secrets, credentials, certificates and the identities of the machines that need them. It is organised as projects, each with environments (development, staging, production) and folders of secrets; secrets can reference each other, carry versions, and be rotated. Machine identities let a pipeline, a container or a service authenticate without a person's credentials; certificates and SSH certificates are issued from it.

It is a downstream fork of Infisical's MIT-licensed core, with the full upstream history, started at a baseline chosen for a reason a secrets platform must give: the version whose data path we watched decrypt every cell of our own vault in an isolated restore, not the newest. A newer upstream earns its place by passing the same proof.

Provenance in every build

Every build carries six values, as environment variables, as labels on the image and as a file inside it, /keyward/provenance.json:

The display string is Keyward 1.0.0-alpha.1 (based on Infisical OSS v0.165.16, 0b52a604). Attribution is a requirement of the licence and a courtesy to the people whose work this builds on, not decoration.

What is changed, and what is not

Upstream's internals (package names, database objects, migrations, API paths) are left alone: renaming them would buy nothing a person can see and would cost a merge conflict forever. What Keyward changes is what a person perceives (the name, the mark, the typography, the pages, the mail) and what security or operation requires. Each change carries a reason in its commit, so the difference between Keyward and upstream can be listed at any time, and is treated as a budget rather than a byproduct.

One change is already in the first build: the typeface upstream ships, whose redistribution rights were not established, is replaced by Inter, under the SIL Open Font License. The build refuses a tree or an image that still contains the old files.

The enterprise boundary

Upstream keeps some of its code under a separate licence, in directories named ee. Keyward does not copy, enable or work around any of it. Those paths are excluded from every Keyward release artifact by policy. The build that enforces that exclusion is not written yet; until it is, every Keyward Server image is labelled internal, for development and testing, and is used for nothing else. "Keyward Enterprise", where this site uses the words, means Keyward's own server tier, built on the MIT core and Keyward's own code: enrolment of computers, central audit and policy, the connector and the relay. See Enterprise.

Running it

Keyward Server is a container image, with PostgreSQL and Redis beside it, behind a reverse proxy that terminates TLS. The staging instance at keyward.vault.exprezoe.com runs that way. It is not a download from this site; the image is published through Exprezoe's own registry to the people who operate it.

What stays yours

Keyward Server runs with upstream's telemetry switched off. It sends nothing to anybody. What it holds is in its own database, on hardware Exprezoe runs, with a nightly recovery set, an off-site copy and a weekly restore that decrypts every cell to prove the keys still work.