ConfigVault.Client 1.0.6

ConfigVault

A configuration management platform with versioning, encryption, rollback support, role-based access control, and full audit logging. Includes a React frontend dashboard and a .NET API backend.

Features

• 🔐 User Authentication — Identity API with registration, login, JWT tokens, 2FA, and password management
• 👥 Role-Based Access Control — Global roles (Admin, User, CreateApplications, etc.) plus granular per-application and per-environment permissions (Read, Write, Delete, Rollback, Tag, RegenerateKey, Decrypt)
• 🔒 Encryption — Encrypt sensitive configuration values using the Data Protection API
• 📜 Version History — Every change creates a new version, maintaining full history
• ⏪ Rollback — Rollback to any previous version, point in time, or tagged version (single key or entire environment)
• 🏷️ Tagging — Tag individual versions or entire environments as "stable", "last-known-good", etc.
• 📊 Audit Logging — Complete audit trail of all changes with user, IP, and user agent tracking
• 🌍 Multi-Environment — Support for Development, Staging, Production, and custom environments
• 📱 Multi-Application — Manage configs for multiple applications under one instance
• 🔌 Client API — Simple API for applications to fetch configs using API keys
• 📤 Import/Export — Bulk import and export configurations per environment
• 📋 Environment Copy — Copy configurations between environments
• 🖥️ Frontend Dashboard — React + TypeScript + Material UI management interface

Images

<img width="3207" height="1864" alt="image" src="https://github.com/user-attachments/assets/01651c4e-55d4-45a5-ba24-bead2cdb13ea" /> <img width="3827" height="2259" alt="image" src="https://github.com/user-attachments/assets/0cbf9e7a-799b-44fa-9165-3ff0d6f74800" /> <img width="1461" height="1461" alt="image" src="https://github.com/user-attachments/assets/73639142-7809-4efd-8755-c93e78b33440" /> <img width="2672" height="1504" alt="image" src="https://github.com/user-attachments/assets/830915c9-3dea-4c7a-9a8b-63c09a67aecc" /> <img width="1171" height="1083" alt="image" src="https://github.com/user-attachments/assets/ba458d4d-b9fa-425f-9553-b6dc580f394b" /> <img width="1093" height="2051" alt="image" src="https://github.com/user-attachments/assets/d6caf54e-185e-4bd3-83bb-19ae115f2d0b" /> <img width="3827" height="2259" alt="image" src="https://github.com/user-attachments/assets/fb1dbfb9-8a9d-46c3-8978-990ede716aab" />

Architecture

ConfigVault/
├── src/
│   ├── ConfigVault.Api/          # ASP.NET Core API (.NET 10)
│   ├── ConfigVault.Core/         # Domain entities, services, interfaces
│   └── ConfigVault.Client/       # .NET IConfiguration provider (NuGet package)
│   └── ConfigVault.FrontEnd/     # React + Vite + TypeScript + MUI dashboard
├── docker-compose.yml
└── Dockerfile

Tech Stack

Backend: ASP.NET Core (.NET 10), Entity Framework Core, PostgreSQL, ASP.NET Identity, Data Protection API, Swagger/OpenAPI 3.1

Frontend: React 19, TypeScript, Vite, Material UI 7, React Router 7, TanStack React Query, Axios (auto-generated API client from Swagger), Topiray Auth

Quick Start

Backend — Using Docker Compose (with PostgreSQL)

docker-compose up -d

The API will be available at http://localhost:8080. Swagger UI is available in development mode at the root URL.

Backend — Local Development

cd src/ConfigVault.Api
dotnet run

Frontend

cd frontend
cp _env .env        # Configure your environment variables
npm install
npm run dev

To regenerate the typed API client from the backend's Swagger spec:

npm run generate-api

Environment Variables

The backend uses the following environment variables for initial setup:

These can also be set via appsettings.json:

{
  "FrontEndHost": "http://localhost:5173",
  "EmailSettings": {
    "Host": "smtp.example.com",
    "Port": 587,
    "EnableSsl": true,
    "Username": "no-reply@example.com",
    "Password": "your-smtp-password"
  },
  "DataProtection": {
    "StorageType": "Database",
    "ProtectionType": "None"
  }
}

Authorization Model

ConfigVault uses a layered permission system.

Global Roles control platform-level actions: Admin, User, CreateApplications, EditApplications, DeleteApplications.

Application Roles are flag-based and can be assigned at two levels:

Permissions can be granted globally for an application (all environments) or scoped to specific environments. Effective permissions are the union of application-level and environment-level grants. Admins bypass all permission checks.

API Overview

Authentication (/api/auth)

Application Management (/api/applications)

Configuration Management (/api/apps/{appName}/envs/{env}/configs)

Environment Operations (/api/apps/{appName}/envs/{env})

User Management (/api/users)

Client API (/api/client) — For Applications

Audit Logs (/api/audit)

Health Check

Configuration Key Conventions

ConfigVault uses the standard .NET configuration key format — colon-separated segments — which maps naturally to structured JSON when consumed by the .NET client. Understanding this convention lets you model objects, nested objects, and arrays as flat key-value pairs.

Objects

Use : to separate property levels. Each segment becomes a level of nesting in JSON.

This is equivalent to:

{
  "Smtp": {
    "Host": "smtp.example.com",
    "Port": "587",
    "EnableSsl": "true"
  }
}

Nested Objects

Additional : segments create deeper nesting.

Resolves to:

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning"
    }
  }
}

Arrays / Lists

Use numeric indices (starting from 0) as the final key segment to represent array elements.

Resolves to:

{
  "AllowedHosts": [
    "example.com",
    "api.example.com",
    "cdn.example.com"
  ]
}

Arrays of Objects

Combine numeric indices with named properties to create arrays of complex objects.

Resolves to:

{
  "DatabaseCluster": {
    "Nodes": [
      { "Host": "db-primary.internal", "Port": "5432", "Role": "primary" },
      { "Host": "db-replica.internal", "Port": "5432", "Role": "replica" }
    ]
  }
}

Binding to C# Classes

Because ConfigVault's .NET client feeds directly into IConfiguration, you can bind these structured keys to strongly-typed options classes as usual:

public class SmtpOptions
{
    public string Host { get; set; }
    public int Port { get; set; }
    public bool EnableSsl { get; set; }
}

// In Program.cs
builder.Services.Configure<SmtpOptions>(builder.Configuration.GetSection("Smtp"));

Tip: When using the ?keyPrefix= query parameter on the list endpoint, you can fetch just a subtree of your config — for example ?keyPrefix=Smtp returns only keys starting with Smtp:.

Usage Examples

1. Register and Login

# Register
curl -X POST http://localhost:8080/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@example.com", "password": "SecurePass123"}'

# Login
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@example.com", "password": "SecurePass123"}'
# Returns: {"accessToken": "...", "refreshToken": "...", ...}

2. Create an Application

curl -X POST http://localhost:8080/api/applications \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-web-app",
    "description": "My Web Application",
    "allowedEnvironments": ["Development", "Staging", "Production"]
  }'
# Returns: {"applicationName": "my-web-app", "apiKey": "cv_...", ...}

3. Create Configuration Values

# Plain text config
curl -X PUT http://localhost:8080/api/apps/my-web-app/envs/Production/configs/key/Smtp:Host \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"value": "smtp.example.com", "changeReason": "Initial configuration"}'

# Encrypted config
curl -X PUT http://localhost:8080/api/apps/my-web-app/envs/Production/configs/key/Smtp:Password \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"value": "super-secret-password", "encrypt": true, "changeReason": "Setting SMTP password"}'

4. Rollback

# Rollback to specific version
curl -X POST http://localhost:8080/api/apps/my-web-app/envs/Production/configs/key/Smtp:Host/rollback \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"toVersion": 1, "reason": "Reverting due to issue"}'

# Rollback to point in time
curl -X POST ... \
  -d '{"toPointInTime": "2024-01-15T10:00:00Z", "reason": "Reverting to last known good state"}'

# Rollback to tagged version
curl -X POST ... \
  -d '{"toTag": "stable", "reason": "Reverting to stable version"}'

5. Tag a Version

curl -X POST http://localhost:8080/api/apps/my-web-app/envs/Production/configs/key/Smtp:Host/versions/3/tag \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tag": "stable"}'

6. Tag an Entire Environment

curl -X POST http://localhost:8080/api/apps/my-web-app/envs/Production/tag \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tag": "release-v2.1", "reason": "Pre-deployment snapshot"}'

7. Client Application Reading Configs

# Get all configs
curl http://localhost:8080/api/client/my-web-app/Production \
  -H "X-Api-Key: cv_YOUR_API_KEY"
# Returns: {"Smtp:Host": "smtp.example.com", "Smtp:Password": "super-secret-password", ...}

# Get specific config
curl http://localhost:8080/api/client/my-web-app/Production/key/Smtp:Host \
  -H "X-Api-Key: cv_YOUR_API_KEY"
# Returns: {"key": "Smtp:Host", "value": "smtp.example.com"}

8. Bulk Import/Export

# Export
curl http://localhost:8080/api/apps/my-web-app/envs/Development/export \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

# Import
curl -X POST http://localhost:8080/api/apps/my-web-app/envs/Staging/import \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"Smtp:Host": "smtp.staging.example.com", "Smtp:Port": "587"}'

# Copy environment
curl -X POST "http://localhost:8080/api/apps/my-web-app/envs/Development/copy-to/Staging?overwrite=true" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

9. User & Permission Management (Admin)

# Create a user
curl -X POST http://localhost:8080/api/users \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "dev@example.com", "password": "DevPass123!", "roles": ["User"]}'

# Grant app-level Read + Write access
curl -X POST http://localhost:8080/api/users/{userId}/applications/my-web-app \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"roles": 3}'

# Grant environment-specific access (e.g. Read only on Production)
curl -X POST http://localhost:8080/api/users/{userId}/applications/my-web-app/environments/Production \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"roles": 1}'

.NET Client Integration

ConfigVault ships a .NET IConfiguration provider for seamless integration. It supports automatic refresh and reads configs directly into your app's configuration pipeline.

// Basic usage
builder.Configuration.AddConfigVault(
    baseUrl: "http://localhost:8080",
    applicationName: "my-web-app",
    environment: builder.Environment.EnvironmentName,
    apiKey: Environment.GetEnvironmentVariable("CONFIGVAULT_API_KEY")!
);

// With options
builder.Configuration.AddConfigVault(
    baseUrl: "http://localhost:8080",
    applicationName: "my-web-app",
    environment: "Production",
    apiKey: "cv_...",
    configure: options =>
    {
        options.RefreshInterval = TimeSpan.FromMinutes(5);
        options.ThrowOnLoadFailure = true;
        options.HttpTimeout = TimeSpan.FromSeconds(30);
    }
);

// From existing configuration (reads ConfigVault:* keys)
builder.Configuration.AddConfigVault(builder.Configuration);

Data Protection Key Management

ConfigVault uses ASP.NET Core Data Protection to encrypt sensitive configuration values. By default, the encryption keys are stored in the database alongside your data. For production deployments, you can configure both where keys are stored and how they are protected at rest.

Storage and protection are independent — you can mix and match any storage provider with any protection provider (with the exception that AWS KMS protection requires AWS Systems Manager storage, since KMS encryption is applied through the SSM persistence layer).

Storage Providers

Protection Providers

Example Configurations

Database + no protection (default / development):

{
  "DataProtection": {
    "StorageType": "Database",
    "ProtectionType": "None"
  }
}

Azure Blob Storage + Azure Key Vault:

{
  "DataProtection": {
    "StorageType": "AzureBlobStorage",
    "ProtectionType": "AzureKeyVault",
    "AzureBlobStorage": {
      "ConnectionString": "DefaultEndpointsProtocol=https;AccountName=...",
      "ContainerName": "dataprotection",
      "BlobName": "keys.xml"
    },
    "AzureKeyVault": {
      "KeyIdentifier": "https://myvault.vault.azure.net/keys/dataprotection"
    }
  }
}

Azure Key Vault authentication uses DefaultAzureCredential, which supports Managed Identity, Azure CLI, environment variables, and more. Optionally set TenantId to pin a specific tenant.

AWS Systems Manager + KMS:

{
  "DataProtection": {
    "StorageType": "AwsSystemsManager",
    "ProtectionType": "AwsKms",
    "AwsSystemsManager": {
      "KeyPrefix": "/DataProtection/ConfigVault/"
    },
    "AwsKms": {
      "KeyId": "alias/configvault-dataprotection"
    }
  }
}

AWS credentials are resolved through the default SDK credential chain (IAM role, environment variables, ~/.aws/credentials, etc.).

Database + Certificate protection:

{
  "DataProtection": {
    "StorageType": "Database",
    "ProtectionType": "Certificate",
    "Certificate": {
      "Path": "/etc/certs/dataprotection.pfx",
      "Password": "cert-password"
    }
  }
}

Alternatively, reference a certificate already installed in the CurrentUser/My store by thumbprint:

{
  "DataProtection": {
    "StorageType": "Database",
    "ProtectionType": "Certificate",
    "Certificate": {
      "Thumbprint": "A1B2C3D4..."
    }
  }
}

Database

PostgreSQL is the supported database, used with Entity Framework Core and automatic migrations on startup.

Connection string format:

Host=localhost;Database=configvault;Username=postgres;Password=yourpassword

Security Considerations

1. API Keys — Store application API keys securely (environment variables, secrets manager). Keys are hashed before storage.
2. Data Protection Keys — By default, encryption keys are stored unprotected in the database. For production, configure a protection provider (Azure Key Vault, AWS KMS, or a certificate) via the DataProtection config section. See Data Protection Key Management above.
3. HTTPS — Always use HTTPS in production.
4. CORS — Configure CorsHosts to restrict allowed origins.
5. Admin Seeding — The first admin user is created from environment variables on startup only if no users exist.
6. Password Policy — Requires 8+ characters with uppercase, lowercase, and digit. Account lockout after 5 failed attempts.

License

MIT License