NeutrinoImplemented

Encrypted secrets vault

Neutrino keeps passwords, API keys and provider credentials encrypted in Valence. Seal, reveal, rotate and lease them, with every change written to a hash-chained audit log.
Neutrino · src/boot.rs
use neutrino::secret_store::{PutSecretRequest, SecretStore};
use neutrino::{create_initial_neutrino_groups, ValenceSealedStore};
use std::sync::Arc;
use valence::Actor;

create_initial_neutrino_groups(&valence).await?;
let store = ValenceSealedStore {
    valence: Arc::new(valence.with_actor(Actor::System {
        operation: "seal_smtp".into(),
    })),
    request_actor: Some("service:smtp-boot".into()),
};
let secret_ref = store
    .put(PutSecretRequest {
        name: "smtp_password".into(),
        scope_path: "/uf-notifications/smtp".into(),
        kind: "password".into(),
        plaintext: b"correct-horse-battery-staple".to_vec(),
        owner_actor: "service:smtp-boot".into(),
    })
    .await?;
Ships inEmbeddedRemote fleet
Works withGluon·Nucleus·Valence

Why it exists

Secrets end up in env files, CI variables and chat logs because there's nowhere better to put them. Neutrino gives each secret an owner, its own permissions and an audit trail, and keeps the plaintext out of your database.

In both templates

Both templates mount the secrets app at /secrets, and Gluon and Nucleus keep their credentials in it.
Seal, reveal and rotate
Implemented
Store secrets encrypted, reveal a specific version, and rotate to a new value with a grace period for the old one.
Leases
Implemented
Lease a secret to a service for a fixed time instead of handing out the value for good.
Hash-chained audit
Implemented
Every put, rotate and delete is appended to an audit chain you can verify. Writes fail if the audit write fails.
Per-secret access
Implemented
Grant view, reveal, edit, delete and maintain on each secret through Gauge, the permissions product.
Master key sources
Implemented
Load the master key from an env var, AWS or Google Cloud KMS, Vault Transit, a PKCS#11 HSM or a TPM.
Gluon and Nucleus handoff
Implemented
Gluon picks up rotated credentials, and Nucleus seals database passwords when it creates a stack.
Neutrino operator UI
Implemented
Manage sealed secrets and their grants on this host at /secrets.

Code sample

Taken from the getting-started docs. See all code samples on Resources.
Neutrino secretNeutrino
Seal a password into the vault at boot
use neutrino::secret_store::{PutSecretRequest, SecretStore};
use neutrino::{create_initial_neutrino_groups, ValenceSealedStore};
use std::sync::Arc;
use valence::Actor;

create_initial_neutrino_groups(&valence).await?;
let store = ValenceSealedStore {
    valence: Arc::new(valence.with_actor(Actor::System {
        operation: "seal_smtp".into(),
    })),
    request_actor: Some("service:smtp-boot".into()),
};
let secret_ref = store
    .put(PutSecretRequest {
        name: "smtp_password".into(),
        scope_path: "/uf-notifications/smtp".into(),
        kind: "password".into(),
        plaintext: b"correct-horse-battery-staple".to_vec(),
        owner_actor: "service:smtp-boot".into(),
    })
    .await?;
Rust docs →Platform guide →
← Platform overview