3.5 KiB
3.5 KiB
Keywarden Documentation
Welcome to the official documentation for Keywarden — a self-hosted, centralized SSH key management and deployment platform.
Table of Contents
- Quick Start Guide — Get Keywarden running in minutes
- Installation & Deployment — Docker setup, reverse proxy, production deployment
- Architecture Overview — System design, components, technology stack
- User Guide — Day-to-day usage for all users
- Administration Guide — Server management, deployments, access assignments, cron jobs
- Roles & Permissions — Owner, Admin, and User role details
- Security — Authentication, MFA, encryption, CSRF, hardening
- Environment Variables — Complete configuration reference
- Email Configuration — SMTP setup, login notifications, invitations
- API Reference — Health check endpoint and internal APIs
- Backup & Restore — Encrypted database backup and restore
- Troubleshooting — Common issues and solutions
- Contributing — Development setup, project structure, guidelines
What is Keywarden?
Keywarden provides a clean web UI to generate, import, and securely store SSH keys (RSA, Ed25519, and Ed448) in one central place. Managed keys can then be deployed to registered Linux servers — individually or via server groups — with a single click. A complete audit log tracks every action in the system.
Key Features
- SSH Key Management — Generate (RSA 2048/4096, Ed25519, Ed448) or import existing key pairs
- Encrypted Storage — All private keys stored with AES-256-GCM encryption at rest
- System Master Key — Auto-generated Ed25519 key used for all server authentication
- Host & Group Management — Register servers, organize them into groups, deploy keys to one or many
- Access Assignments — Map users + keys to target hosts/groups with specific system users, sudo rights, and user creation
- Temporary Access (Cron Jobs) — Schedule time-limited access with automatic key removal, user disabling, or user deletion on expiry
- Three-Tier Role System — Owner, Admin, and User roles with clear permission boundaries
- User Invitations — Invite new users via secure email links with self-service password setup
- Key Enforcement — Bastillion-style enforced key management: detect and remove unauthorized SSH keys automatically
- TOTP Two-Factor Authentication — Optional or enforced MFA for all users
- Password Policies — Configurable complexity requirements with account lockout
- Email Notifications — Login alerts and invitation emails via SMTP
- Comprehensive Audit Log — Every action logged with user, timestamp, IP address, and details
- Encrypted Backup/Restore — Full database export with AES-256 password encryption
- Docker-Native — Single-container deployment with SQLite, no external database needed
- Security Hardened — CSRF protection, CSP headers, rate limiting, request size limits
Community
Have questions, ideas, or feedback? Join the Keywarden Matrix chat room:
License
Keywarden is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0-or-later).
© 2026 Patrick Asmus (scriptos)