Infisical – open-source HashiCorp Vault alternative

Check out this demo as well: https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infis...

We put a lot of work into engineering but also the design and messaging of the platform to developers as well :)

Sentry is using the BSL, the very same license that HashiCorp has switched to but that change has not been received well.

Every single open source company eventually learns this when they have a strong competitor. Eventually you are forced to stop being open source, because no business wants to compete solely on the strength of their service quality.

Moreover: a community is antithetical to a corporation's interest in the software. Corporations don't give a shit what people want changed in the code, for good reason: their purpose is to make money, not make good software. So business source always ends up annoying and limited while community open source provides the functions the users need, in the way they want them.

So, yeah, you can make money while letting people read your source code. But the actual quality of the end result, the user's happiness, the ability to contribute to the whole thing, is much different in a real community project.

If you want to write software, in a community, for the betterment of that everyone, no matter what anyone else does with that software, then release it as open source.

Can you still make a comfortable living writing open source software? Perhaps, but if that's your goal, you're doing it wrong(tm).

When you rely on OSS products that are developed almost exclusively by companies, you just need to assume that one day there's going to be a rug pull and plan accordingly.

I'd also note that we are able to offer all the features you list without requiring users to opt-out of end-to-end encryption.

But, of course, too few features can be just impractical.

Dynamic secrets generation isn't built in to EnvKey, but we do offer a CLI that makes it straightforward to generate or rotate credentials/roles as part of your deployment. Rather than baking in this kind of thing, we are more taking a 'give you simple building blocks so you can do anything' approach to automations. For your postgres example, it would look something like this:

  # Set variables for an EnvKey environment that includes postgres admin creds in shell 
  eval $(envkey-source)

  # Use the admin credentials from EnvKey to rotate credentials for app role in Postgres. 
  # You could also create new roles, grant privileges, etc., as needed.
  NEW_PASSWORD=$(openssl rand -base64 32)
  psql -h $DB_HOST -U $DB_ADMIN_USER -d $DATABASE_NAME -c "ALTER ROLE $ROLE_NAME WITH PASSWORD '$NEW_PASSWORD';"

  # Update the credentials in EnvKey for your app.
  envkey set app-name production DB_PASSWORD=$NEW_PASSWORD --commit --json

  envkey-source --watch -- ./run-my-app.sh

  envkey-source --watch --rolling -- ./run-my-app.sh

For acting as a CA, we have some ideas on how to accomplish this that I think would be both simpler and more secure than Vault's approach, but we haven't gotten to it yet.

One is envkey-source (https://docs-v2.envkey.com/docs/envkey-source), which contains core client-side decryption and verification logic. It can be used standalone from the shell like this:

  # some-command runs with EnvKey vars in its environment
  $ envkey-source -- ./some-command 

  # EnvKey vars are set in current shell
  $ eval $(envkey-source)
  $ echo $SOME_ENVKEY_VAR 

It allows you to integrate with a Go project like this:

  // main.go
  import (
    "os"
    _ "github.com/envkey/envkeygo/v2"
  )

  // assuming you have GITHUB_TOKEN set in EnvKey
  token := os.Getenv("GITHUB_TOKEN") // this will stay in sync

I think there may be a mix-up here with Infisical Cloud which is the managed service with subscription tiers.

Yeah, I've noticed that the app is not enforcing that limit ATM, but the limit was clearly visible in the dashboard when I tried it a couple of months ago (OSS, docker)

Any reason to believe this to be true this time around?