Subumbra is a split-trust key broker. Encrypted blobs live on your infrastructure, while transient decryption authority runs in Cloudflare during live upstream handling. Cloudflare deploy authority remains part of the trust boundary.
Tested providers
Built-in adapters
How it works
A one-shot ./bootstrap.sh encrypts provider
material and deploys enforcement to Cloudflare. After that, subumbra-keys on your side only stores ciphertext
envelopes and wrapped DEKs — never usable upstream secrets at rest.
subumbra.yaml and edit providers, routing, and
adapter names. For CI or unattended runs, copy .env.bootstrap.example to .env.bootstrap and add Cloudflare credentials
plus the same secret_ref values referenced
in the manifest.Run ./bootstrap.sh on the host. Think
of it as the one “setup” button: it starts the bootstrap container, deploys or updates the Worker in
Cloudflare, encrypts your provider keys into the local store, and tells you when to bring the stack up —
without leaving a trail of plaintext secrets in the repo as part of that run.
If you use interactive mode, you answer prompts for Cloudflare credentials and each provider secret; those answers stay in process memory for the session and are not written back into the project as cleartext.
If you already copied .env.bootstrap.example
to .env.bootstrap and filled it in, the
same script runs headlessly, then securely shreds that file after a successful pass so it does not linger on
disk.
When the script exits cleanly, your .env
contains the adapter tokens the stack expects, encrypted material is on the volume, and the core containers
can start normally.
Update your apps wherever they read provider settings — .env files, YAML or JSON config, admin UIs,
or secrets in your orchestrator. Where you used to paste the real vendor key and call the provider directly,
aim traffic at Subumbra and put the narrow adapter token in the credential field instead. The key_id from your manifest still goes in the URL
path right after /t/ (below, anthropic_prod is only an example).
.env for the real provider secret.
Features
:8090/t. No app code changes
— swap the base URL and use a key ID instead of a real key.subumbra.yaml; bootstrap publishes
structured entries to Cloudflare KV so the Worker can validate every upstream target fail-closed.subumbra-keys only
ever persists envelopes (ciphertext + wrapped DEKs). Apps and operators use narrow adapter tokens — not the
upstream key material.SUBUMBRA_TOKEN_LITELLM). LiteLLM,
Bifrost, Open WebUI, AnythingLLM, LibreChat, n8n, and custom HTTP clients are supported via the transparent /t route.Security model
Split trust means ciphertext and wrapped DEKs on your infrastructure are useless without the matching RSA private key held in a Cloudflare Durable Object. A complete break requires defeating both sides — plus your manifest-defined adapter and policy controls at the Worker boundary. Cloudflare and your deploy credentials remain explicit trust boundaries.
subumbra:v3:<key_id>:<policy_hash>,
binding ciphertext to the policy in effect at encryption time and blocking transplant or stale-policy replay.allow.adapters
binds each adapter token to specific records; policy can scope methods, paths, hosts, and capability class so a
compromised chat app cannot silently pivot to unrelated APIs.subumbra-proxy
requests envelopes from subumbra-keys with
per-request HMAC integrity and freshness controls so replayed or forged fetches fail closed.Self-hosted, open source, deployable in minutes. Your infrastructure. Your control. No plaintext key storage on your servers after bootstrap.