🔐 sinduk - Secrets Management CLI & Team Vaults

sinduk (সিন্দুক — the traditional Bengali word for a secure treasure chest or heirloom vault) is a secure, local-first secrets manager and team vault system designed for developers and DevOps teams. Store, retrieve, sync, and share passwords, API tokens, and SSH credentials with strong cryptography, master password verification, role-based permissions, and zero-knowledge synchronization.

🌟 Key Features

• 🔒 Local-First & Zero-Knowledge: Secrets are encrypted at rest with PBKDF2-HMAC-SHA256 and Fernet (AES-128-CBC + HMAC). Plaintext never touches the network unencrypted.
• 👥 Team Vaults & RBAC: Create isolated team vaults (dev-infra, prod-keys) with granular roles (viewer, editor, admin) and encrypted key-wrapping per member.
• 🔄 Multi-Target Vault Sync: Push and pull encrypted vault bundles across team members using a shared directory (Dropbox, Google Drive, NAS, Git) or via the built-in self-hosted server.
• 🖥️ Self-Hosted Zero-Knowledge Relay Server: Run your own team sync server (sinduk server start) with token authentication and audit logging. The server never has access to encryption keys or secrets.
• 📦 Encrypted Backups: Export and import full encrypted vault backups with master password protection.
• 💻 Modern Web UI: Interactive browser dashboard (sinduk web) featuring a Vault Switcher, Secrets CRUD, Team Member Management, Audit Log Viewer, and an in-browser SSH Terminal.
• 🔑 SSH Key Management: Store and auto-connect to SSH servers using credentials or key files.
• 📋 Clipboard & Pipeline Integration: Copy secrets directly to clipboard (--clip) or pipe command outputs (sinduk cc).
• 🔗 LinklyHQ URL Shortening: Built-in shortlink generator with click tracking.

🚀 Installation

Recommended: pipx (isolated environment)

pip install pipx
pipx ensurepath
pipx install sinduk

Standard pip

pip install sinduk

Install from source

git clone https://github.com/imshakil/sinduk.git
cd sinduk
pip install -e .

Verify installation:

sinduk version
sinduk --help

📖 Command Reference

👥 Team Vaults & Collaboration

1. Initialize Your Team Identity

Each team member initializes their identity once:

sinduk team init
# Enter display name: Alice
# ✅ Identity set! User ID: d164fe8724cb

To see your identity anytime:

sinduk team whoami

2. Create a Team Vault

sinduk team create-vault dev-infra -d "Backend infrastructure & database credentials"

3. Add Teammates to the Vault

Add members using their unique User ID:

# Add Bob as an editor
sinduk team add-member dev-infra a8f910e1234 --name "Bob" --role editor

# Add Charlie as a read-only viewer
sinduk team add-member dev-infra b7c821f9876 --name "Charlie" --role viewer

Available roles:

• viewer: Read secrets in the vault
• editor: Read, add, update, and delete secrets
• admin: Full control (manage members, roles, audit log, delete vault)

4. Working with Secrets in Team Vaults

Simply pass --vault <name> or -v <name> to any secret command:

# Add a secret to the team vault (using --type or auto-detection)
sinduk add --vault dev-infra --type password postgres_db postgres db_pass_secret
sinduk add --vault dev-infra --type token stripe_key sk_test_12345

# List secrets in the team vault
sinduk list --vault dev-infra

# Retrieve a secret from the vault
sinduk get --vault dev-infra postgres_db --clip

# View immutable audit log of actions taken in the vault
sinduk team audit-log dev-infra

🔄 Syncing Vaults Across the Team

Sinduk offers seamless zero-knowledge synchronization across team members with automatic background push, live server verification, and offline directory fallback.

Option A: Self-Hosted Zero-Knowledge Relay Server (Recommended)

1. Start the Sync Server (DevOps / Admin)

Run on any Linux server, VPS, or cloud container:

# Start the server daemon on port 58380
sinduk server start --host 0.0.0.0 --port 58380 --daemon

# Generate a team token
sinduk server token create --name "DevTeam" --role admin

2. Configure Team Members

Each team member configures their client once. Sinduk actively verifies server connectivity and bearer token validity before saving:

sinduk sync config set --server http://secrets.mycompany.internal:58380 --token sinduk_tok_...

(Tip: Use --force to save configuration offline without live network checks).

3. Automatic Background Sync ⚡

Once configured, all team vault changes are pushed automatically whenever you modify secrets or membership:

• sinduk add --vault dev-infra ... ➡️ Auto-pushed to server
• sinduk update --vault dev-infra ... ➡️ Auto-pushed to server
• sinduk delete --vault dev-infra ... ➡️ Auto-pushed to server
• sinduk team add-member dev-infra ... ➡️ Auto-pushed to server

4. Manual Push, Pull, and Status

You can also manually synchronize or check remote vault versions at any time:

# Push local vault updates to the server
sinduk sync push dev-infra

# Check status of remote vault vs local vault
sinduk sync status dev-infra

# Pull and merge latest changes from the server
sinduk sync pull dev-infra

5. Web UI Sync Controls 🌐

When using the browser dashboard (sinduk web):

• Click "Sync Server" in the top navigation bar to configure server URL and bearer token with live connection testing.
• Use the "🔄 Sync" 1-click button on any team vault card to instantly pull and push changes.

Option B: Offline / Shared Directory Sync (No Server)

Sync encrypted bundles through Dropbox, Google Drive, NAS, or Git:

# Push encrypted bundle to shared directory
sinduk sync push dev-infra --to ~/Dropbox/TeamSecrets/

# Pull and merge from shared directory (supports both .sinduk and .pacli files)
sinduk sync pull dev-infra --from ~/Dropbox/TeamSecrets/

📦 Encrypted Backups

Export and import encrypted backup archives of personal or team vaults:

# Backup personal store
sinduk backup export --output ~/sinduk_backup.sinduk

# Backup a specific team vault
sinduk backup export --vault dev-infra --output ~/dev_infra_backup.sinduk

# Restore backup
sinduk backup import --input ~/dev_infra_backup.sinduk --vault dev-infra

🌐 Web UI

Launch the modern browser-based UI:

# Start and open in default browser
sinduk web

# Start in background mode (daemon)
sinduk web start

# Check status / Stop
sinduk web status
sinduk web stop

💡 Pro Tips

Session-based Master Password

Avoid typing your master password repeatedly by exporting it in your current terminal session:

export SINDUK_MASTER_PASSWORD="your-master-password"

Pipeline & Clipboard Tools

# Copy SSH public key to clipboard
cat ~/.ssh/id_rsa.pub | sinduk cc

# Copy command output
terraform output -json | sinduk cc

📄 License

Distributed under the MIT License. Built with ❤️ by imShakil.