Encrypted secret storage
Protect passwords, keys, certificates, and binary files with a separately managed master key.
Configuration, under control
Keep your app’s secrets in safe hands.
CONFSAFE gives your team one secure place for application settings, credentials, keys, and config files — organized by project and environment, ready when your pipeline needs them.
Self-hosted · Encrypted at rest · Read-only pipeline access
PROJECT / storefront
Configuration objects● Protected
DB_PASSWORD
••••••••
API_ENDPOINT
URL
app.envfile
FILE
› confsafe get storefront.prod.DB_PASSWORD ●●●●●●
One source of truthScoped access for every environment
Purpose & features
Everything your apps need.
Nothing left scattered.
Keep configuration close to the teams and workflows that use it. CONFSAFE connects a clear admin interface with simple, read-only access for automation.
Projects & environments
Organize values by application and environment. Environment-specific entries take precedence over project defaults.
Versioned configuration
Every save creates a new version. Review history and restore an earlier version when you need it.
Pipeline-ready CLI
Fetch a value, write a protected file, or resolve placeholders in a template from scripts and CI jobs.
Expiry awareness
Set validity periods for secrets and keys. Admins receive reminders before and when an item expires.
Scoped, read-only tokens
Give a project or one environment its own revocable token for API and CLI access. Token values are shown once.
One-step secret sharing
Create a time-limited, one-time link to share a text secret. The link expires or is consumed after it is opened.
Audit trail
Keep a record of changes and API access so activity can be traced to users, tokens, and projects.
Self-hosted by design
Run CONFSAFE in your own Docker environment and keep control of the service and its encryption key.
Built for careful accessSecrets stay protected from storage through delivery.
Encrypted contentHashed tokensAccess logsRole-based permissions
Minimal quick start
Up and running
in a few steps.
Start the self-hosted stack, create an administrator, then let your pipeline read only what it needs.
01
Start CONFSAFE
Launch the Docker Compose stack from the project directory.
docker compose up -d
02
Prepare the database
Apply the database migrations once the application is running.
docker compose exec app php artisan migrate
03
Create the first administrator
Set up the initial super admin account and sign in to the web UI.
docker compose exec app php artisan confsafe:create-super-admin
04
Add a project and its values
Create a project, add environments, then store secrets, parameters, keys, or config files. Generate a read-only token for the required scope.
05
Read values in your pipeline
Set the server URL and token as protected CI variables, then use the CLI.
# Fetch a value
confsafe get storefront.prod.DB_PASSWORD
# Resolve placeholders in a file
confsafe parse storefront.envfile .env --env prod --strict
confsafe get storefront.prod.DB_PASSWORD
# Resolve placeholders in a file
confsafe parse storefront.envfile .env --env prod --strict
Contact
Let’s talk CONFSAFE.
Questions, feedback, or ideas? Get in touch with us.