博客
WSLVault: Steal the Server. Not the Secrets.
Open-source secrets manager with envelope encryption, true multi-tenancy, KV/transit/PKI/leases, multi-region HA, and hash-chained audit
本页内容
Steal the server. Not the secrets. WSLVault is an open-source, self-hosted secrets manager built on AES-256-GCM envelope encryption and a per-tenant key hierarchy. This intro covers what it is, why the model matters, and how you drive it from console, CLI, or SDKs. Deep dive: long article · Product: /wsl-vault.
Watch on YouTube (~20 min)
WSLVault is built for operators who want Vault-compatible workflows without plaintext at rest: Rust services, Helm/GitOps on Kubernetes, CLI plus Go/Python/Rust/TypeScript SDKs, and a steel/brass web console.
What you will learn
- True multi-tenancy — Team A cannot decrypt Team B (cryptographic refusal, not “oops”)
- Envelope encryption — DEK → tenant KEK → root KEK (KMS / HSM / Shamir)
- Engines — KV secrets, transit encryption, PKI, dynamic leases, MFA
- Operations — Active/active multi-region replication and tamper-evident, hash-chained audit
- Why it matters — Steal the disk ≠ steal the secrets
Links
- Site: https://www.wslvault.org/
- GitHub: https://github.com/bwalia/wslvault
- Docs: docs/
- Getting started: GETTING-STARTED.md
- TenthMatrix product page: /en/wsl-vault
Read the full technical brief · Open the WSL Vault tools page
更多博客文章
Observability Is Not Optional: Make It a Business Standard
Why fragmented monitoring creates blind spots, duplicate spend, and slow incidents — and how to make centralised observability a non-negotiable company standard.
WSL Vault for Compliance: One Tenant Never Opens Another’s Secrets
How WSL Vault keeps app, team, and environment tenants cryptographically isolated — so a stolen root-style token cannot empty the estate — and why dual-tenant control beats secrets sprawl.
Workstation AI Shop: Promoting the AI Sales Storefront Through int → test → acc → prod
Workstation AI Shop sells GPU machines with a fully autonomous AI Sales Agent that configures the basket. See how Ring Promoter moves each build through int → test → acc → prod — with Orbit screenshots release engineers and stakeholders share.