ReactorcoremeltdownandClaude Opus 5
967d9c0e2e
location / covered /invite/{token}, /oidc/callback, /device and
/healthz along with the web interface, so Vouch stood in front of all
of them. An invite link was the worst of it: it goes to somebody who has
no account anywhere yet, and Vouch bounced them to a login they cannot
pass. The OIDC callback was fragile for a different reason — the
authorization code it carries is single-use and short-lived, and a
second login round trip is a poor place to spend it.
Those four paths now proxy straight through. KeepOrg authenticates each
of them itself: an invite is a capability token, the callback is checked
against its state, a device code expires in ten minutes, and /healthz is
unauthenticated by design. /web keeps Vouch in front of it, and /api was
already exempt.
The proxy settings move to the server block, where every location
inherits them, and the upstream becomes a named block. location / has to
repeat the headers in full: a location that sets one proxy_set_header
replaces the inherited set rather than adding to it.
Checked with nginx -t and against a running keeporgd with a 401 standing
in for Vouch: /, /web and /web/* redirect to auth.tiredsysadmin.cc,
while /healthz, /invite/, /device and /oidc/* serve KeepOrg's own pages
and /api returns KeepOrg's 401.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
KeepOrg
A synchronization adapter for KeePass. Your databases stay ordinary .kdbx
files that KeePassXC, KeePass2 or KeePassDX opens directly; a server keeps
them in step between everyone who has access.
When two people save at once, the server can merge both edits: it opens the two copies in memory, folds them together by KeePass's own rules and stores the result. Nothing is lost, and no one has to reconcile two files by hand.
Merging means decrypting, so a merge vault's password is kept on the server, encrypted under a master key held outside the data directory. That makes the server part of your trust boundary. Vaults on any other conflict strategy keep their key off the server entirely, exactly as before.
- Server (
keeporgd, Linux): hosts many KDBX databases, controls access with a tree of user groups, accepts registrations by invite link or OIDC, merges concurrent edits, and pushes updates to connected clients. Its web page at/webis for creating a vault and setting its password. - Desktop client (
keeporg, Linux, macOS, Windows, BSD): mirrors every assigned database into one directory as a real file, pushes each save and applies what others push. - Android client: the same, published to every file picker as a storage provider.
No third-party dependencies, no cgo, no FUSE. The KDBX 4 codec, including ChaCha20, BLAKE2b and Argon2, is part of the repository and is tested against both the relevant RFCs and a real KeePassXC.
Quick start
make check # gofmt, vet, tests
make all # keeporgd and keeporg for this host
# a server for trying it out, on 127.0.0.1:8765
KEEPORG_ADMIN_PASSWORD=dev-password-1 make run-server
# in another shell
build/linux-arm64/keeporg login -server http://127.0.0.1:8765 -user admin
build/linux-arm64/keeporg groups
build/linux-arm64/keeporg vault -create "Team Vault" -group <group-id>
build/linux-arm64/keeporg run
Team Vault.kdbx appears in ~/KeepOrg; open it in KeePassXC with the vault
password you just set. Every save is pushed, and a save that races with a
colleague's is merged rather than refused.
Or open http://127.0.0.1:8765/web and create the vault from the browser.
Packaging
make deb # Debian packages for the client and the server
make docker # server container image, scratch-based, about 9 MB
make dmg # macOS disk image with an /Applications symlink (on macOS)
make windows # Windows zip with a Task Scheduler job
make android # unsigned release APK (needs the Android SDK)
make help # every target
Running the server in a container:
head -c 32 /dev/urandom | base64 > master.key
podman secret create keeporg_master_key master.key
podman run -d -p 8765:8765 \
--secret keeporg_master_key \
-e KEEPORG_MASTER_KEY_FILE=/run/secrets/keeporg_master_key \
-e KEEPORG_ADMIN_PASSWORD=change-me \
-v keeporg-data:/var/lib/keeporg \
keeporgd:latest -addr :8765 -data /var/lib/keeporg -url https://keeporg.example.com
Keep that master key: it unwraps the vault keys, and without it the server
can no longer merge. KEEPORG_MASTER_KEY takes the base64 key directly if
your secret store injects variables instead of files. See
packaging/docker/compose.yaml.
Documentation
- docs/HANDOVER.md — architecture, the decisions behind it, operations, and what is left to do.
- docs/PROTOCOL.md — the HTTP API.
- android/README.md — the Android module.