Steal the server. Not the secrets.
Open-source, self-hosted secrets management built on AES-256-GCM envelope encryption and a per-tenant key hierarchy — so a stolen disk, database dump, or compromised host still leaves attackers with ciphertext they cannot open.
WSLVault is a Vault-compatible secrets platform for operators who want encrypted-at-rest multi-tenancy without plaintext on disk. Drive it from the steel/brass web console, CLI, Go/Python/Rust/TypeScript SDKs, or MCP — with Helm/GitOps deploy on Kubernetes.
Watch on YouTube: https://youtu.be/O6q3_H0k2M8
Team A cannot decrypt Team B — cryptographic refusal, not an application oops.
DEK → tenant KEK → root KEK (KMS / HSM / Shamir). Secrets sealed before they touch disk.
Versioned KV, transit encryption, PKI, dynamic leases, identity policies, and MFA.
Active/active multi-region replication and a tamper-evident, hash-chained audit trail.
Vault-compatible KV v2: versioned reads/writes, check-and-set, soft-delete and destroy — every value sealed before storage.
Encrypt, decrypt, sign and verify without plaintext keys leaving the vault. Rotate keys while old ciphertext stays readable.
Private CA, roles, and short-lived certificates. CA private keys are envelope-encrypted, never stored in the clear.
Credentials are leases: issued, listed, renewed, and revoked for real. Revoke stops access immediately.
TOTP two-factor, recovery codes, fine-grained policies on API keys and JWTs — plus SCIM, LDAP, OIDC, mTLS and workload auth.
A database dump yields ciphertext wrapped under keys the database never sees. Steal the disk ≠ steal the secrets.
Ship with the Helm chart and Kubernetes operator, drive from GitOps, scrape with Prometheus, and reach WSLVault from your language of choice — or from an AI agent over the built-in MCP server.
Read getting startedClone the repo, install the Helm chart, and unseal. Workstation helps operators run WSLVault with the same edge and promotion discipline as WSL Proxy and Ring Promoter.
Visit wslvault.orgContact Workstation