Why We Built a Config and Secrets Manager That Never Phones Home

Description and use

KeyKosh is a self‑contained config and secrets manager that never contacts external servers, uses offline Ed25519 licensing, and offers graceful degradation, enabling teams to manage configurations without cloud dependencies.

Problem

Self‑hosted teams need a config manager that can be installed, owned, governed, and run without outbound network calls, yet still provide governance features like RBAC, SSO, and audit logging.

Outcome

KeyKosh delivers a self‑hosted config manager that never contacts external servers, uses offline Ed25519 licensing, degrades gracefully on license errors, and offers a free tier with a 14‑day trial. It eliminates per‑seat billing and provides robust governance features.

Workflow

• 1. Obtain a one‑time license key from keykosh.com
• 2. Deploy the Docker image with a Postgres database
• 3. Configure organization → application → environment hierarchy
• 4. Use Java/Node/Python SDKs to fetch scoped config via tokens
• 5. (Optional) Enable offline cache by configuring SDK settings

Evidence

Activation is an Ed25519 signature verified against a public key bundled in the image. No license server, no callback, no outbound call ever.

Source

Paid keys are domain‑bound to prevent resale. But a key on the wrong host, an expired trial, a revoked key — the install drops to the free tier's limits and keeps serving config.

Source

The platform and the three SDKs (Maven Central, npm, PyPI — MIT and readable on GitHub) are built and tested end to end.

Source