selfhost.directory

The index of self-hostable projects — ranked, categorized and served with live updates.
Own your data and stop giving it to big tech.

GitHubWebsite
OpenSigner logo

Self-host OpenSigner

Non-custodial wallet key management with threshold crypto

AlphaOpen SourceMIT
GitHubWebsite
Install
Updatedlast week
LanguageGo
Setup difficultyAdvanced
Stars
152
Ports
7050 (iframe (key reconstruction)), 7051 (iframe-enabled sample page), 7052 (auth service), 7053 (cold storage), 7054 (hot storage), 7055 (documentation site)
Requires
PostgreSQL, Shield (cold storage)
Docker
ghcr.io/openfort-xyz/shield
Install with Docker Compose

What is OpenSigner?

OpenSigner is an open-source, self-hostable wallet key management system for non-custodial embedded wallets. It splits private keys into device, hot, and cold shares using Shamir's Secret Sharing, reconstructing them only in memory during signing. The system works with multiple wallet infrastructure providers and integrates with existing authentication stacks (OIDC, passkeys, email). It supports Ethereum, Solana, and other chains using a unified key management approach. The project is currently under security audit by Quantstamp and is MIT-licensed. Deployment uses Docker Compose with multiple services including iframe key reconstruction, authentication, hot and cold storage, and PostgreSQL.

Should you self-host OpenSigner?

OpenSigner scores 40/100 on selfhost.directory (how scoring works) and ranks #12 of 12 in Secrets Management. It has 152 GitHub stars.

There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.

Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is MIT-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is Infisical (78/100, 30 062 stars). It scores higher overall, so compare the two before you pick. See OpenSigner vs Infisical side by side.

Features

  • Auth-agnostic integration
  • Multi-Chain Support
  • Non-custodial key management
  • Open-source and self-hostable
  • Security auditOngoing audit by Quantstamp
  • Threshold key management
  • Vendor-neutral architecture

OpenSigner README

How to install OpenSigner

Install OpenSigner with Docker Compose

Docker, Docker Compose
Environment variables
JWT_SECRET, SHARE_ENCRYPTION_KEY, POSTGRES_PASSWORD, AUTH_SERVICE_DB_PASS, HOT_STORAGE_DB_PASS, COLD_STORAGE_DB_PASS, BETTER_AUTH_BASE_URL, ALLOWED_ORIGINS, TRUST_PROXY, AUTH_SERVER_URL, AUTH_JWT_ISSUER, AUTH_JWT_AUDIENCE, GOOGLE_JWT_AUDIENCE, ALLOW_INSECURE_AUTH_SERVER, AUTH_SERVICE_DB_SSLMODE, HOT_STORAGE_DB_SSLMODE, COLD_STORAGE_DB_SSLMODE, IFRAME_HOST_PORT, IFRAME_SAMPLE_HOST_PORT, AUTH_SERVICE_HOST_PORT, COLD_STORAGE_HOST_PORT, HOT_STORAGE_HOST_PORT, DOCS_HOST_PORT, NODE_AUTH_TOKEN

git clone https://github.com/openfort-xyz/opensigner.git cd opensigner cp .env.example .env

then fill in every REQUIRED value; each has a generator command in the comments

make build make run

Requires Docker and Docker Compose. Set database passwords before first start.

How to configure OpenSigner

  • ALLOWED_ORIGINShttp://localhost:7050,http://localhost:7051Origins allowed to embed the iframe and call the APIs (comma-separated).

    Origins allowed to embed the iframe and call the APIs (comma-separated).

  • ALLOW_INSECURE_AUTH_SERVERfalseLocal development only. Permits fetching the JWKS over plaintext HTTP. Never enable in production.

    Local development only. Permits fetching the JWKS over plaintext HTTP. Never enable in production.

    values: true,false

  • AUTH_JWT_AUDIENCEExpected JWT audience enforced by hot_storage. Defaults to BETTER_AUTH_BASE_URL.

    Expected JWT audience enforced by hot_storage. Defaults to BETTER_AUTH_BASE_URL.

  • AUTH_JWT_ISSUERExpected JWT issuer enforced by hot_storage. Defaults to BETTER_AUTH_BASE_URL.

    Expected JWT issuer enforced by hot_storage. Defaults to BETTER_AUTH_BASE_URL.

  • AUTH_SERVER_URLhttp://authservice:3000Internal address hot_storage uses to FETCH the JWKS. Must be https unless ALLOW_INSECURE_AUTH_SERVER=true.

    Internal address hot_storage uses to FETCH the JWKS. Must be https unless ALLOW_INSECURE_AUTH_SERVER=true.

  • AUTH_SERVICE_DB_PASSPer-service DB credentials for auth_service. Typically holds the same value as POSTGRES_PASSWORD.

    Per-service DB credentials for auth_service. Typically holds the same value as POSTGRES_PASSWORD.

  • AUTH_SERVICE_DB_SSLMODErequireTLS mode for database connections. docker-compose.dev.yml overrides this to disable for local runs.

    TLS mode for database connections. docker-compose.dev.yml overrides this to disable for local runs.

  • AUTH_SERVICE_HOST_PORT7052Host port mapping for auth_service.

    Host port mapping for auth_service.

  • BETTER_AUTH_BASE_URLhttp://localhost:7052auth_service's externally visible base URL. Keys off this: the iss and aud claims on issued JWTs, and whether session cookies get the Secure flag (https:// => Secure). Use https:// in production.

    auth_service's externally visible base URL. Keys off this: the iss and aud claims on issued JWTs, and whether session cookies get the Secure flag (https:// => Secure). Use https:// in production.

  • COLD_STORAGE_DB_PASSPer-service DB credentials for cold_storage. Typically holds the same value as POSTGRES_PASSWORD.

    Per-service DB credentials for cold_storage. Typically holds the same value as POSTGRES_PASSWORD.

  • COLD_STORAGE_DB_SSLMODErequireTLS mode for database connections. docker-compose.dev.yml overrides this to disable for local runs.

    TLS mode for database connections. docker-compose.dev.yml overrides this to disable for local runs.

  • COLD_STORAGE_HOST_PORT7053Host port mapping for cold_storage service.

    Host port mapping for cold_storage service.

  • DOCS_HOST_PORT7055Host port mapping for docs service.

    Host port mapping for docs service.

  • GOOGLE_JWT_AUDIENCEOAuth client ID accepted for x-auth-provider: google. Leave unset to reject that provider.

    OAuth client ID accepted for x-auth-provider: google. Leave unset to reject that provider.

  • HOT_STORAGE_DB_PASSPer-service DB credentials for hot_storage. Typically holds the same value as POSTGRES_PASSWORD.

    Per-service DB credentials for hot_storage. Typically holds the same value as POSTGRES_PASSWORD.

  • HOT_STORAGE_DB_SSLMODErequireTLS mode for database connections. docker-compose.dev.yml overrides this to disable for local runs.

    TLS mode for database connections. docker-compose.dev.yml overrides this to disable for local runs.

  • HOT_STORAGE_HOST_PORT7054Host port mapping for hot_storage service.

    Host port mapping for hot_storage service.

  • IFRAME_HOST_PORT7050Host port mapping for iframe service.

    Host port mapping for iframe service.

  • IFRAME_SAMPLE_HOST_PORT7051Host port mapping for iframe-sample service.

    Host port mapping for iframe-sample service.

  • JWT_SECRETApplication secret for auth_service (better-auth). Signs session cookies and encrypts the JWKS private signing key at rest. Minimum 32 characters; the service refuses to start on a weak or default value.

    Application secret for auth_service (better-auth). Signs session cookies and encrypts the JWKS private signing key at rest. Minimum 32 characters; the service refuses to start on a weak or default value.

  • NODE_AUTH_TOKENGitHub Packages token, only needed to build the docs image.

    GitHub Packages token, only needed to build the docs image.

  • POSTGRES_PASSWORDPostgreSQL password. Set before first start: Postgres bakes the password in at volume initialisation, so changing it later requires ALTER USER or a fresh volume. Hex, not base64.

    PostgreSQL password. Set before first start: Postgres bakes the password in at volume initialisation, so changing it later requires ALTER USER or a fresh volume. Hex, not base64.

  • SHARE_ENCRYPTION_KEYAES-256-GCM key encrypting hot shares at rest. Exactly 64 hex characters.

    AES-256-GCM key encrypting hot shares at rest. Exactly 64 hex characters.

  • TRUST_PROXYfalseSet to true only when exactly one reverse proxy fronts auth_service. Rate limiting then keys on the address the proxy saw.

    Set to true only when exactly one reverse proxy fronts auth_service. Rate limiting then keys on the address the proxy saw.

    values: true,false

More in Secrets Management

Rate this project

Click to rate — no account needed.

0 comments

Posting as guest
Loading comments…