Public Alpha (v1.0.0-alpha.9): local-first Project Vault + Secrets Vault.
Your local-first source of truth for configs, secrets, and teams.
SuchConfig is built for developers who need one trusted, local-first place for sensitive project work: passwords, configs, secrets, and the tools that support secure day-to-day engineering.
Main focus: project-scoped knowledge, secrets with placeholders, and credentials. Offline by default, merge-friendly over time with CRDTs, with no cloud vault or sync of your note contents.
Heavy active development. This is the first public cut of the open-core CE. APIs, UX, and sync behavior will change. Expect rough edges; please read Current status before depending on any path in production.
Open core lets you audit the vault crypto and run a free local vault with user-owned backup (Trusted Folder) and opt-in LAN sync as those layers mature.
Coming soon: signed & notarized macOS installers (DMG), a headless suchconfig CLI for developer workflows, plus the public launch of suchconfig.io. Until then, build from source or grab unsigned alpha builds from GitHub Releases.
| License | Apache-2.0 |
| Platform | macOS primary; Linux / Windows best-effort |
| Docs | docs/README.md · Public Alpha roadmap · Keyboard shortcuts |
| Releases | GitHub Releases |
| Site | suchconfig.io |
| Area | Status |
|---|---|
| Project Vault + Secrets Vault (offline, CRDT) | Usable (dogfood; still evolving) |
| Trusted Folder sync | Shipped (Free) |
| LAN Wi‑Fi P2P | Pairing + Handoff verified; incremental deltas and firewall-ON hardening still open; not finished LAN sync |
| On-device vault importer | First password-manager JSON path dogfood-ready (Free); more formats planned |
| CLI (sidecar + headless) | Coming; same suchconfig binary bundled with desktop and installable for CI / agents |
| Signed / notarized macOS builds | Stated honestly on download pages when published |
| Pricing | Hidden during Public Alpha |
Detail: docs/public-alpha-roadmap.md · docs/open-core.md
| Capability | Notes |
|---|---|
| Project Vault + Secrets Vault + encrypted archives | Offline CRDT-backed store |
| Trusted Folder | User-owned folder backup / merge |
| LAN Wi‑Fi P2P | Opt-in, same LAN; maturity above |
| Vault Importer | On-device; first password-manager JSON path shipped; more formats planned |
Never paywalled: Trusted Folder, LAN P2P, or Vault Importer (when it ships).
A local-first vault for AI-augmented development: project configs, secrets, prompts, and encrypted archives on your machine, with no SuchConfig-hosted vault database.
- Tauri 2 shell + embedded Phoenix LiveView (
phoenix-app/) - Vault crypto / CRDT in open
vault_core(vendored in public CE builds) - Multi-device continuity is user-owned (folder you choose, or opt-in LAN sync)
- CLI: same
suchconfigbinary as a desktop sidecar and as a headless install for scripts, CI, and agents
Not in this repo: SuchUtils (parsers / generators; separate product). The installable CLI lives in a sibling runtime; Public Alpha CE is the vault app.
Prerequisites: Rust (rustup), Node 18+, pnpm, Elixir / Erlang matching phoenix-app/.tool-versions (asdf recommended).
mix is only on your PATH after Elixir is installed and your shell has loaded asdf (or another Elixir install). Run Mix commands from phoenix-app/, not the repo root.
git clone https://github.com/suchconfig/suchconfig-app.git
cd suchconfig-app
pnpm install
cd phoenix-app
# confirm: which mix # should print a path; if not, open a new login shell or install Elixir via asdf
mix deps.get
mix ecto.migrate
cd ..
pnpm run tauri:devPhoenix-only (browser): cd phoenix-app && mix setup && mix phx.server → http://localhost:4000.
Asset deps from repo root: pnpm run phoenix-assets:install.
Once the app is running, ⌘K / Ctrl+K opens the command palette. Full chord map: docs/keyboard-shortcuts.md.
Public Alpha CE resolves Mix / Cargo against the vendored
vault_corein this tree. Private founder builds may use sibling path deps; that wiring is not required for public CE.
SuchConfig
├── Tauri shell (Rust): OS bridges, LAN P2P transport, passkey bridges, CLI sidecar spawn
├── Phoenix LiveView: Project Vault + Secrets Vault UI, SQLite
├── vault_core: Loro CRDT + crypto (sole writer path for merge)
└── suchconfig CLI: Local Broker runtime (bundled sidecar and headless)
Vault load / save / merge does not use the network. Optional license checks and updater stay outside the vault trust boundary. See SECURITY.md and P2P security.
Desktop is the control plane (scopes, credentials, Start Broker). The Local Broker runtime is a single suchconfig CLI:
| How | Use it when |
|---|---|
| Sidecar | You use the app. Desktop writes the scope manifest and spawns the bundled CLI. |
| Headless | You want the CLI on PATH for CI, agents, or terminal workflows — no GUI required. |
| Attach | The app already started Broker; call suchconfig broker status / api call / broker run against that socket. |
This is not a second vault. The CLI resolves placeholders and injects credentials for scoped API calls; agents and scripts see names, not plaintext. The same binary is bundled with desktop and can be installed on its own as packaging matures.
Elixir is the primary application language because SuchConfig is a long-running local product: vault UI, domain logic, SQLite, and orchestration need fault-tolerant concurrency more than a single-process SPA. OTP supervision, immutable data, and {:ok, _} / {:error, _} pipelines keep product code explicit and crash-isolated inside the embedded BEAM sidecar.
| Layer | Role |
|---|---|
| Elixir + Phoenix LiveView | Product surface: Project Vault / Secrets Vault UI, forms, PubSub-driven updates, and most domain orchestration over local SQLite |
| Tauri 2 (Rust shell) | Desktop trust boundary: OS bridges, keychain / passkeys, file dialogs, LAN P2P transport, window lifecycle, CLI sidecar spawn |
Rust (vault_core) |
Hot path: Loro CRDT merge, vault crypto, and encrypted archive packing (sole writer path for merge) |
suchconfig CLI |
Local Broker runtime: bundled sidecar or headless install for CI, agents, and command-line workflows |
LiveView keeps the UI server-driven with a thin client, so we ship less custom frontend state for a security-sensitive vault. Rust stays where systems work belongs (native APIs, crypto, CRDT). Elixir stays where product logic and realtime local UX belong. That split is intentional, not “Elixir for everything.”
Dev (pnpm run tauri:dev) and installed release builds use separate SQLite files. Missing data after switching modes is usually two databases, not a sync bug. See docs under docs/README.md.
See CONTRIBUTING.md (DCO, conventional commits). Good first issues: docs, UX, tests.
Public Alpha is early: prefer issues and small docs/UX/test PRs. Expect breaking changes between alpha tags.
Created by zanuka (Mike Delucchi)
Copyright © 2026 Mike Delucchi
Licensed under the Apache License, Version 2.0.