Oshrin

Open-source, self-hosted secrets management for developers.

Stack: ts-rest | Express | React | PostgreSQL | Drizzle ORM | pnpm workspace

Quick Start

git clone https://github.com/idrsdev/oshrin.git
cd oshrin
cat > .env <<EOFJWT_SECRET=$(openssl rand -base64 32)JWT_REFRESH_SECRET=$(openssl rand -base64 32)ENCRYPTION_KEY=$(openssl rand -base64 32)POSTGRES_PASSWORD=$(openssl rand -base64 16)CORS_ORIGIN=http://localhostVITE_API_URL=http://localhost:3000VITE_AUTH_STRATEGY=HEADER_BASEDEOF
docker compose up -d

Open http://localhost

Development

pnpm setup # install deps + copy .env files
pnpm dev:db # start postgres
pnpm db:push # create tables
pnpm dev # start all (shared + api + web)

Commands

pnpm dev # all services
pnpm dev:api # API only
pnpm dev:web # web only
pnpm build # build all
pnpm type-check # TypeScript validation
pnpm lint # lint API# Database
pnpm db:push # sync schema to local DB (dev only)
pnpm db:generate # generate migration from schema changes
pnpm db:studio # open Drizzle Studio

Structure

oshrin/
├── api/ # Express + ts-rest
├── shared/ # Shared types/contracts
├── web/ # React frontend
└── pnpm-workspace.yaml

Environment Variables

Required:

Variable	Description
JWT_SECRET	Access token signing key (32+ chars)
JWT_REFRESH_SECRET	Refresh token signing key (32+ chars)
ENCRYPTION_KEY	Master encryption key (backup this — loss = permanent data loss)
POSTGRES_PASSWORD	Database password

Optional:

Variable	Default	Description
CORS_ORIGIN	http://localhost	Allowed CORS origin
AUTH_STRATEGY	COOKIE_BASED	HEADER_BASED or COOKIE_BASED
VITE_AUTH_STRATEGY	HEADER_BASED	Must match AUTH_STRATEGY
VITE_API_URL	http://localhost:3000	API URL for the frontend
APP_URL	http://localhost:8080	Used in email links

See api/.env.example for the full list including rate limits, timeouts, cookie settings, and resource limits.

Production

Critical:

• Use HTTPS
• Set CORS_ORIGIN to your domain
• Match AUTH_STRATEGY and VITE_AUTH_STRATEGY
• Use COOKIE_BASED auth with COOKIE_SECURE=true
• Backup ENCRYPTION_KEY

Docker Images

Image	Description
idrsdev/oshrin:api-latest	API server
idrsdev/oshrin:web-latest	Web UI

# Build locally
docker build -t idrsdev/oshrin:api-latest -f api/Dockerfile .
docker build -t idrsdev/oshrin:web-latest -f web/Dockerfile .

Or use the GitHub Actions workflow (Actions → Build and Publish Docker Images → Run workflow).

API Documentation

Development only (disabled in production):

• Swagger UI: http://localhost:3000/docs
• OpenAPI spec: http://localhost:3000/openapi.json

Docs

• Architecture — system design, data model, auth, encryption
• Database — Drizzle ORM workflow and migrations
• Security — encryption details, limitations, vulnerability reporting
• Privacy — data collection and storage
• Terms — terms of service

License

MIT — Created by Malik Idrees (@idrsdev) • LinkedIn