Keywarden is a self-hosted web application for centralized SSH key management and deployment. It lets you generate, store, and deploy SSH keys to Linux servers from a single web interface — with full audit logging, role-based access control, and automated temporary access scheduling.
Keywarden is currently in alpha status.
- Do NOT expose this application directly to the public internet. Use it only in trusted, private networks.
- The software may contain bugs, incomplete features, or security issues.
- Your feedback is valuable! If you discover bugs or have suggestions, please open an Issue on GitHub. Every report helps improve the project.
- SSH Key Management — Generate (RSA 2048/4096, Ed25519, Ed448) or import existing keys
- Encrypted Storage — Private keys encrypted at rest with AES-256-GCM
- Server & Group Management — Register servers, organize into groups
- Access Assignments — Declarative access model: assign users + keys to servers with system user, sudo, and user creation
- Temporary Access — Schedule time-limited access with automatic expiry (key removal, user disable, or user deletion)
- Three-Tier Roles — Owner, Admin, and User with distinct permissions
- User Invitations — Invite users via secure email links
- Key Enforcement — Bastillion-style enforced key management: automatically detect and remove unauthorized SSH keys from servers
- Two-Factor Authentication — TOTP-based MFA, optionally enforced for all users
- Password Policies & Account Lockout — Configurable complexity rules and brute-force protection
- Audit Log — Every action tracked with user, IP, timestamp, and details
- Update Notifications — Automatic update check with version badge in the header for admins
- Encrypted Backup/Restore — Full database export with password-based encryption
- Docker-Native — Single container with embedded SQLite, no external database required
- Docker and Docker Compose
git clone https://git.techniverse.net/scriptos/keywarden.git
cd keywardenCreate a .env file and generate two separate cryptographically secure keys:
# Generate keys (run twice, once per key):
openssl rand -base64 48KEYWARDEN_SESSION_KEY=<first generated string>
KEYWARDEN_ENCRYPTION_KEY=<second generated string>Important: Change both keys to unique random strings. The encryption key protects all stored SSH private keys — if lost, they cannot be recovered. See the Quick Start Guide for more options to generate secure keys.
docker compose up -ddocker compose logs keywardenLook for the auto-generated admin password in the output:
════════════════════════════════════════════════════════════
Initial owner account created
Username: admin
Password: <auto-generated>
Please change this password after first login!
════════════════════════════════════════════════════════════
Navigate to http://your-host:8080 and log in. You will be prompted to change the password.
After login, copy the system master key (shown in Admin Settings and in the startup logs) and add it to the authorized_keys of the root user on every server you want to manage:
echo "ssh-ed25519 AAAA... keywarden-system-master" >> /root/.ssh/authorized_keysFor detailed documentation, see the docs/ folder:
- Quick Start Guide
- Installation & Deployment — Docker, reverse proxy, HTTPS
- Architecture — System design and components
- User Guide — SSH keys, settings, MFA
- Admin Guide — Servers, deployments, access assignments, cron jobs
- Roles & Permissions — Owner, Admin, User role details
- Security — Encryption, authentication, hardening
- Environment Variables — Full configuration reference
- Email Configuration — SMTP, notifications, invitations
- Backup & Restore — Encrypted database backup
- Troubleshooting — Common issues and solutions
- Contributing — Development setup and guidelines
Keywarden is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0-or-later).
© 2026 Patrick Asmus (scriptos)
Join the Keywarden Matrix chat to discuss the project, ask questions, or share feedback:
| URL | |
|---|---|
| Primary (Gitea) | git.techniverse.net/scriptos/keywarden |
| Mirror (GitHub) | github.com/pscriptos/keywarden |
| Container Registry | git.techniverse.net/scriptos/-/packages/container/keywarden |
The primary repository is hosted on Gitea. The GitHub repository is a read-only mirror.
Bug reports & feature requests: Please open an Issue on GitHub — registration on the Gitea instance is currently closed.