Tuck

Note

This project is backed by the Dimwit Pledge.

Tuck is a small, self-hosted vault for SSH keys, hosts and files. One download sets up ~/.ssh on any machine.

Everything is encrypted in your browser before it's saved, so the server only ever holds ciphertext. You unlock it with a password and then three questions you wrote, and each answer is part of the key.

Read the docs →

Run it

cp .env.example .env    # set POSTGRES_PASSWORD
docker compose up -d

Or pull the image directly: docker pull ghcr.io/dimwitlabs/tuck:1.

Put Tuck behind an HTTPS reverse proxy, set TUCK_TRUSTED_PROXIES, then sign up. Each instance has one account, and sign-up closes after the first. The setup guide walks through it, including nginx and your own Postgres.

Worth knowing

• There's no recovery: Forget the password or an answer and the vault is gone. Keep an export somewhere safe.
• Run it yourself: Whoever runs the server could change the page and capture what you type. SECURITY.md and the threat model cover the rest.

Development

cd web && npm install && npm run build && cd ..
TUCK_DATABASE_URL=postgres://tuck:tuck@localhost:5432/tuck TUCK_SECURE_COOKIES=false go run ./cmd/tuck

Tests: npm test in web/, and go test ./... with TUCK_TEST_DATABASE_URL pointing at a Postgres. The site lives in landing/ and docs/ (npm start in docs/).

Licence

MIT