Your secrets.
Your repo. Your rules.
DaemonHound encrypts, tracks, and syncs your .env files, API keys, and machine configs across all your machines — using your own private Git repoas the backend. No SaaS. No accounts. No third-party servers.
🔐 Age encryption
Every file encrypted with age before it touches disk. Keys never leave your machine.
🔄 Auto-sync daemon
Optional background daemon polls your vault every 30s. Changes propagate automatically.
🧠 Smart merge
Git conflicts? Semantic drivers understand .env, JSON, CSV, and TOML structure.
🌐 Web UI dashboard
Browse files, manage secrets, resolve conflicts — all from your browser. dhd ui
Why DaemonHound?
Most solutions are either SaaS subscriptions or overly complex. Own your toolchain.
Without DaemonHound
- Manually copy-paste
.envfiles - Secrets accidentally committed
- Rotating an API key means hunting every file
- No idea which machine has what version
- Pay for yet another SaaS subscription
With DaemonHound
- One command to track, encrypt, and sync
- Everything encrypted before Git sees it
- Rotate a secret — all files update automatically
dhd statusshows clean, dirty, pending- Free and open source forever
How it works
Namespace-based routing. Age encryption. Your own Git repo.
Initialize
dhd init --remote [email protected]:you/my-vault.git generates an age identity, clones your vault, and installs the daemon. Under 30 seconds.
Track files
dhd track .env.local reads the Git remote, derives a namespace, encrypts with age, and stores it in your vault.
Sync across machines
dhd discover ~/projects scans repos and restores tracked files to correct local paths.
Let the daemon run
Polls every 30s. Changes from any machine pulled and applied. Conflicts resolved with smart merge.
Everything you need
Opinionated defaults. Minimal config. Maximum productivity.
Named secrets
Store once, map to different env var names per project. Rotate a secret and every referenced file rewrites instantly.
Smart merge engine
Semantic merge drivers resolve .env, JSON, CSV, and TOML conflicts at the content level.
Web UI
Browser dashboard: 3-way conflict diff, file browser with syntax highlighting, secret history, live daemon logs.
Background daemon
30s polling. Auto-pull, auto-push, auto-merge. Native launchd, systemd, and Task Scheduler integration.
Cross-platform
macOS (Homebrew), Linux (APT), Windows (Scoop). Signed & notarized DMG, GPG-verified releases.
Lightweight vault access
dhd clone and dhd read let you access vault contents without full machine init. Partial clone with sparse checkout.