What we've put out.
The things we build for ourselves, given away.
Some of the work doesn't belong to a client. Tools we needed, wrote properly, and had no reason to keep. They'll show up here as they're cleaned up enough to hand over.
secret-bunker-iroh
A small secrets service that stores secrets encrypted at rest and serves them over iroh — peer-to-peer QUIC dialed by public key. No TLS certificates or CAs to configure: the bunker's identity is its ed25519 key, and a connected peer can do nothing until that key is granted access. Ships with a Kubernetes operator that syncs bunker secrets into native Secret objects via a BunkerSecret custom resource.
go-secret-bunker-iroh
Pure-Go client for secret-bunker-iroh, with no CGO, built on the native Go iroh implementation. The client's identity is its ed25519 key — authenticated in the QUIC handshake, authorized against the bunker's ACLs. No certificates, no tokens. Covers the full protocol, from reads and compare-and-set writes to the admin operations.
Want to build something in the open?
We're happy to talk about work that ends up public — libraries, tooling, or the boring infrastructure everyone rewrites.
Start a conversation