Self-host Dopbase
0.1.10Single-binary secrets manager with encrypted SQLite storage
- Stars
- 168
- Port
- 8840 (HTTP server for REST API and Admin UI)
What is Dopbase?
Dopbase is a self-hosted secrets manager for developers and teams that organizes secrets by project and environment. It runs as a single executable containing the server, REST API, embedded Vue Admin UI, and command-line client. Secrets are encrypted with envelope encryption (XChaCha20-Poly1305) and stored in a SQLite database, with the master key kept outside the database. The CLI can import from .env, JSON, YAML, or TOML files and inject secrets directly into application processes via dopbase run. It supports role-based access (root, admin, member, AI agent), environment-scoped runner tokens for CI/CD, encrypted backups, and audit logging. Self-hosting is the primary deployment model with native executables for macOS and Linux on AMD64 and ARM64; Windows users run it in a Docker container. The project is pre-1.0 (v0.1.x) with a roadmap toward SSO, KMS integration, and high availability.
Should you self-host Dopbase?
Dopbase scores 43/100 on selfhost.directory (how scoring works) and ranks #11 of 12 in Secrets Management. It has 168 GitHub stars.
It shipped 10 stable releases in the past year. The latest, 0.1.10, came out on 26 October 2026. New versions land roughly every 2 days.
Setup is easy: most people get it running in one sitting. It is Apache-2.0-licensed and written mostly in Rust.
Its closest alternative on selfhost.directory is Infisical (78/100, 30 062 stars). It scores higher overall, so compare the two before you pick. See Dopbase vs Infisical side by side.
Features
- Audit Logging
- CLI secret injection
- Embedded Admin UI
- Encrypted backups
- Encrypted secrets storage
- Import/export multiple formats
- Projects and environments
- REST API with OpenAPI/Swagger
- Role-based Access Control
- Runner tokens for CI/CD
Dopbase README
More in Secrets Management
InfisicalInfisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
Onetime SecretKeep passwords and other sensitive information out of your chat logs and inboxes.
One Time SecretOpen-source, self-hosted secret sharing: encrypted one-time links that vanish after viewing, with a REST API, SMTP delivery, and MFA, passkeys and SSO in full mode.
OpenBaoOpenBao is an open-source secrets manager forked from Vault, governed by the OpenSSF for self-hosted deployments.
OpenSignerOpen-source, self-hosted key management for embedded wallets using Shamir's Secret Sharing across Ethereum and Solana.
PadlocOpen-source, end-to-end encrypted password manager with shared vaults, MFA, a built-in authenticator and encrypted file storage; self-hosted via Docker Compose or Node.
phaseSelf-hosted secrets manager with end-to-end encryption for storing and deploying application secrets across environments.
shelveOpen-source, self-hosted secrets manager for dev teams: keep API keys and .env values in an encrypted vault with team roles, activity logging, scoped tokens and a CLI.
Sup3rS3cretMes5ageOpen-source, self-hosted service for one-time secret sharing via HashiCorp Vault. Auto-deletes after read, supports files, TTL, TLS, and CLI.
TeampassSelf-hosted, open-source team password vault on PHP/MySQL: folder and role access control, AES-256-GCM encryption, LDAP/OAuth2 SSO, TOTP and compliance reports.
vaultSelf-hosted, source-available secrets server that issues dynamic cloud and database credentials, offers encryption as a service, and logs every access for audit.
YopassOpen-source, self-hosted secret sharing: Yopass encrypts passwords and files in the browser with OpenPGP, so links carry the key and secrets expire or burn after reading.
0 comments