Victoria

Victoria should be an easy usable and very light-weight secret exchange that keeps the secrets strictly in memory without ever dumping them.

The backend was written in golang while the frontend was written in Typescript with solid js.

Everything ships as a single image: the Go binary serves the API under /api/ and the embedded frontend build for everything else.

Development

Run both and open http://localhost:3000, Vite proxies /api to the backend on :8080:

$ cd backend && go run ./src
$ cd frontend && npm run dev

Releasing

$ make release VERSION=1.2.0 REGISTRY=registry.example.com

From a clean master that is in sync with origin, this builds victoria:1.2.0 and victoria:latest locally for linux/amd64 (the server, also when releasing from an arm64 Mac) and tags the commit as v1.2.0. It then asks before tagging the image for the registry and pushing it together with the git tag. Without REGISTRY it stops after the local build and prints the push commands. PLATFORM=linux/arm64 releases for another platform. REGISTRY can also be set once in a git-ignored .release.env.

make image builds a local image for your machine named after git describe, e.g. victoria:1.2.0-3-gabc1234. make image PLATFORM=linux/amd64 builds it for the server instead.

Nothing is configured at build time, the version is only used for the image labels and logged at startup.

Running

$ docker run -d --restart unless-stopped --read-only -p 3766:8080 \
    -e TRUSTED_PROXIES=192.168.2.1 \
    registry.example.com/victoria:1.2.0

Or with deployment/compose.yml: create a .env next to it (see the comment in the file), then docker compose pull && docker compose up -d. It runs latest unless VERSION is set, e.g. VERSION=1.1.0 to roll back.

Variable	Default	Description
PORT	8080	Listening port
TRUSTED_PROXIES	empty	Comma separated IPs/CIDRs whose X-Real-IP header is trusted for the access log
ACCESS_LOG	true	false disables the access log (stdout, nginx combined format plus request time)
RATE_LIMIT	true	false disables rate limiting per client IP (needs TRUSTED_PROXIES behind a proxy)
RATE_LIMIT_REQUESTS_PER_SECOND	10	Sustained requests per second per client
RATE_LIMIT_REQUEST_BURST	50	Requests a client can make at once before being limited
RATE_LIMIT_CREATES_PER_MINUTE	10	Sustained secret creations per minute per client
RATE_LIMIT_CREATE_BURST	10	Secrets a client can create at once before being limited

TLS termination is expected on an outer proxy. It should set X-Real-IP and can restrict which paths get forwarded:

location ~ ^/($|about$|secrets/|untouched/|assets/|api/) {
    limit_except GET POST DELETE { deny all; }
    client_max_body_size 100k;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://192.168.2.22:3766;
}

location / {
    return 404;
}

Backend information

Read the README.md in the backend directory for more information about setup

Frontend information

Read the README.md in the frontend directory for more information about setup