Docker & Local Infrastructure
Relevant source files
The following files were used as context for generating this wiki page:
SecretForge AI utilizes a local-first infrastructure strategy designed to ensure maximum security and developer autonomy. By prioritizing local services and containerized environments, the system enables zero-knowledge secret management where sensitive data remains under the developer's control. The local infrastructure supports development, testing, and edge-native deployments through a combination of Docker containers and local database engines.
The primary goal of this infrastructure is to provide a "Zero-Config" experience while maintaining strict security boundaries. It integrates local AI models via Ollama, local state management via SQLite, and containerized services for caching and relational storage.
Sources: README.md, PHASE1_IMPLEMENTATION.md:10-15, SYSTEM_EVALUATION.md:460-465
Containerized Services
The project uses Docker Compose to orchestrate essential services required for the full SecretForge AI stack during local development and testing.
Core Local Services
The infrastructure is composed of several critical backend services that simulate the production environment:
| Service | Technology | Purpose |
|---|---|---|
| Local AI | Ollama | Runs local LLMs (e.g., Llama 3.1) for CLI-based AI interactions. |
| Worker Simulation | Miniflare | Simulates the Cloudflare Workers environment locally. |
| Relational Storage | PostgreSQL | Provides a secondary relational data store for non-secret metadata. |
| Caching/State | Redis | Handles session state and temporary caching. |
Sources: README.md, WARP.md:55-60
Service Orchestration Flow
The following diagram illustrates how the local services interact when a developer initiates the infrastructure via Docker.
The Docker Compose configuration ensures that all dependencies are isolated and reproducible across different development environments.
Sources: README.md, WARP.md:34-40
Local Storage Architecture
SecretForge AI employs a local-first storage strategy centered around SQLite for its core secret vault. This allows for high-performance CRUD operations without network latency or external dependencies.
SQLite Implementation
The primary data store is a localized SQLite database, typically residing in the user's home directory.
- Location:
~/.secretforge/<project>.db - Driver:
better-sqlite3(synchronous operations for CLI efficiency). - Schema Properties: Uses an
environmentcheck constraint and JSON arrays for tagging.
Sources: PHASE1_IMPLEMENTATION.md:20-45, SYSTEM_EVALUATION.md:255-265
Secret Vault Schema
The database is structured to support multi-project and multi-environment isolation within a single local file.
| Field | Type | Constraints | Description |
|---|---|---|---|
id | TEXT | PRIMARY KEY | Cryptographically secure UUID. |
name | TEXT | NOT NULL | The key name (e.g., STRIPE_API_KEY). |
project | TEXT | NOT NULL | Project identifier. |
environment | TEXT | CHECK (dev, staging, prod) | Deployment context. |
value_encrypted | TEXT | NOT NULL | AES-256-GCM encrypted payload. |
tags | TEXT | DEFAULT '[]' | JSON array for categorization. |
Sources: PHASE1_IMPLEMENTATION.md:46-58
Local AI Infrastructure
A unique aspect of the SecretForge infrastructure is the integration of local LLMs to handle secret detection and provisioning tasks without sending sensitive metadata to third-party cloud AI providers.
Ollama Integration
The CLI is configured to interact with Ollama for local AI processing. This is particularly used for:
- Service Detection: Analyzing
package.jsonto identify required providers. - Interactive Chat: Natural language assistance for secret rotation and configuration.
Sources: README.md, packages/mcp-server/src/index.ts:320-330
This local loop ensures that project metadata never leaves the local environment during the initial scanning phase.
Sources: README.md, scripts/launch.sh:110-120
Infrastructure Setup & Management
Managing the local infrastructure is handled through a set of shell scripts and CLI commands that automate environment preparation.
Prerequisites & Setup
The infrastructure requires Node.js 18+, pnpm 8+, and Docker. The setup.sh script automates the initialization of the local environment.
# Start local services
docker compose up -d
# Initialize local database and project config
sf init
Sources: WARP.md:34-40, PHASE1_IMPLEMENTATION.md:105-115
Deployment to Edge
While development is local-first, the infrastructure is designed to be "Edge-Native." Once local development is complete, the stateful AI and storage can be deployed to Cloudflare's infrastructure using the following components:
- D1: For edge-based SQLite storage.
- KV: For high-speed secret retrieval.
- Vectorize: For semantic search of API documentation.
Sources: README.md, scripts/launch.sh:420-435
Conclusion
The Docker and local infrastructure of SecretForge AI provide a robust foundation for secure secret management. By utilizing Docker for complex services like Redis and PostgreSQL, while keeping the core secret vault in a local SQLite database, the project achieves a balance of portability and high security. The integration of Ollama further enhances this by enabling privacy-preserving AI analysis directly on the developer's machine.