Skip to content

Set up a key server for the organization

Problem: Team folders need a place for their keys – without license limits and without a vendor gaining access to data.

Solution: Krywerk Server on your own premises: a Docker Compose stack with automatic TLS, sign-in via Keycloak connected to Microsoft 365 (Entra ID), and a web administration.

Result: A key server, compatible with Cryptomator Hub, that never sees files or decrypted keys – with an audit log, daily backup and health check.

Prerequisites

  • A Linux server with Docker and Docker Compose, reachable under two DNS names, e.g. keys.example.org (Krywerk Server) and login.example.org (Keycloak); ports 80 and 443 open.
  • For Microsoft 365: permission to create an app registration in Entra ID.
  • About 1 GB of RAM and a few GB of storage (the database only contains keys and metadata).

Steps

  1. Get the repository: 
    git clone https://github.com/mzilinski/krywerk /opt/krywerk
cd /opt/krywerk/crates/kw-server/deploy
  2. Settings: create krywerk.env from krywerk.env.example and fill .env with your domains and random passwords – exactly as described in Operation › With your own Keycloak.
  3. Start and check: 
    alias kc='docker compose -f compose.yaml -f compose.keycloak.yaml'
kc up -d
kc run --rm server check
curl https://keys.example.org/health      # → ok
  4. Connect Microsoft 365: app registration in Entra ID and identity provider entra in Keycloak – Operation › Accounts from Entra ID.
  5. Assign roles: everyone gets user; anyone allowed to create team folders gets create-vaults; IT administration gets admin.
  6. Enable the web administration: create the client krywerk-verwaltung in Keycloak and set KRYWERK_SERVER_WEB=1 – Web administration › Setup. Then sign in at https://keys.example.org/verwaltung/.
  7. Set up backups: a daily cron job with backup.sh, plus an off-site copy – Backup.
  8. Tell your users: the address https://keys.example.org for Settings › Organization account in the app.

Overview of the Krywerk Server web administration

Privacy

The server stores names, email addresses, groups and shares, but no files. What exactly, for how long and who can see it: Privacy and data flows – the basis for your record of processing activities.

Next steps