Run ShrouDB
on your own servers.
Moat is the ShrouDB server. It runs every engine in one process on infrastructure you control, so your keys and your data never leave your network.
Start it with Docker
Give Moat a config file and a master key. It keeps its data in the /data volume.
$ docker run --rm \
-p 8200:8200 -p 8201:8201 \
-v "$(pwd)/moat.toml:/etc/moat/moat.toml:ro" \
-v moat-data:/data \
-e MOAT_CONFIG=/etc/moat/moat.toml \
-e SHROUDB_MASTER_KEY \
-e MOAT_ADMIN_TOKEN \
shroudb/moat:latestOne process to deploy
All engines are compiled into one binary. Engines that depend on each other, such as Veil on Cipher, call each other in-process.
HTTP or RESP3
HTTP on port 8200 and RESP3 on port 8201 accept the same commands and the same tokens. The SDKs handle either.
One config file
moat.toml sets which engines run, where data is stored, and which tokens can do what. Unknown keys are rejected at startup.
Encrypted on disk, always
Every change is encrypted with AES-256-GCM before it's written. Storage keys are derived per namespace from one master key, so that's the one secret you protect.
Split engines out later
Any engine can run as its own process, with Moat forwarding to it. Clients don't change, so you can scale a busy engine separately.
Tokens with narrow access
Each token is limited to specific engines and namespaces, read-only where possible. With no tokens configured, Moat refuses every request.
Don't want to run it yourself?
ShrouDB Cloud runs the same engines for you, with the same API.