Own your secrets. Stay secure. Empower developers. zopp is the open-source, self-hostable, CLI-first secrets manager that keeps your secrets safe and your workflow fast.
Lint Build Test Security Audit Coverage
- Open-source: transparent code, community-driven, contributions encouraged.
- Self-hostable: your secrets, your infra — deploy where you trust.
- Local-first: works fully offline; no vendor lock-in.
- Safe: passphrase → Argon2id; per-environment keys; AEAD for secret values.
- Developer-focused: import/export
.env, inject into processes, zero boilerplate.
Create a zopp.toml in your project directory:
[defaults] workspace = "acme" project = "api" environment = "development"
Supports zopp.toml, zopp.yaml, zopp.yml, or zopp.json.
# Set a secret (uses zopp.toml defaults) zopp secret set DATABASE_URL "postgresql://..." # Get a secret zopp secret get DATABASE_URL # Override environment zopp secret set API_KEY "prod-key" -e production # Export to .env file zopp secret export -o .env # Inject secrets into a command zopp run -- npm start
See DEMO.md for the complete workflow.
Deploy zopp server and operator to your Kubernetes cluster:
# Install from OCI registry (recommended) helm install zopp oci://ghcr.io/faiscadev/charts/zopp --version 0.1.0 # Or install from source git clone https://github.com/faiscadev/zopp.git cd zopp helm install zopp ./charts/zopp # Customize with PostgreSQL backend helm install zopp oci://ghcr.io/faiscadev/charts/zopp \ --version 0.1.0 \ --set server.database.type=postgres \ --set server.database.postgres.url="postgres://user:pass@host/db" # Operator-only mode (connect to external server) helm install zopp oci://ghcr.io/faiscadev/charts/zopp \ --version 0.1.0 \ --set server.enabled=false \ --set operator.server.address="zopp.example.com:50051"
See charts/zopp/README.md for complete Helm chart documentation.
curl -fsSL https://raw.githubusercontent.com/faiscadev/zopp/main/install.sh | shcargo install --git https://github.com/faiscadev/zopp --package zopp-cli
Download the latest release from GitHub Releases.
# Pull latest stable release docker pull ghcr.io/faiscadev/zopp-cli:latest alias zopp='docker run --rm -v ~/.zopp:/home/zopp/.zopp ghcr.io/faiscadev/zopp-cli:latest'
cargo build --workspace --release
- Development Guide - Setup, building, running locally
- Testing Standards - Testing philosophy, coverage targets
- Documentation - Docs workflow and guidelines
- Releasing - Release process