Doriath: a zero-knowledge secrets vault inside Nextcloud

Passwords, API keys, tokens, certificates — every team has them, and most teams keep them somewhere they shouldn't. Doriath puts them in the workspace people already log into, encrypted so that not even the administrator can read them. The full recording is above.

What we covered

• Why a secrets vault belongs in the workspace rather than beside it — Doriath reuses Nextcloud's own users, groups, notifications and unified search instead of rebuilding them
• How zero-knowledge encryption actually works here: RSA-4096 per secret, AES-256 wrapping the private key behind a master password that is never stored
• The private Certificate Authority Doriath bootstraps on your instance — root and intermediate, signing every user and application certificate, renewing itself
• Personal vaults in practice: folders, fuzzy search, copy-to-clipboard, and secrets surfacing in unified search without ever exposing a decrypted value
• Sharing built for teams: share with a user or a Nextcloud group, sync-on-update, one-click revocation, password-protected links with a usage limit, and temporary ownership delegation when an owner is unavailable
• Application credentials, not just passwords: CSR-based registration, the admin approval queue, write-without-read secrets, and the signed JWT assertion (RFC 7523) applications exchange for a short-lived Bearer token
• Audience Q&A on threat model, recovery, and what happens when someone forgets their master password

Go deeper

Speakers

Conduction's Doriath lead, walking through the vault, the sharing model, and the application credential flow on a live instance.

Resources

• Slide deck (linked once the recording is up)
• The instance used in the demo
• Source and issues: Doriath on Codeberg