Doorman Plugins¶
Doorman plugins integrate with specific secret stores. Each plugin knows how to authenticate with and retrieve secrets from one backend, outputting secrets in a universal entity format.
Plugin Inventory¶
Active¶
| Plugin | Integrates With | Language | Notes |
|---|---|---|---|
doorman-keepassxc |
KeePassXC password manager | Go | Reference implementation |
Stubs (Awaiting Implementation)¶
Cloud Providers¶
| Plugin | Integrates With |
|---|---|
doorman-aws |
AWS Secrets Manager / SSM Parameter Store |
doorman-digitalocean |
DigitalOcean secrets |
doorman-linode |
Linode/Akamai secrets |
doorman-vultr |
Vultr secrets |
doorman-ovh |
OVH secrets |
doorman-rackspace |
Rackspace secrets |
Secret Managers¶
| Plugin | Integrates With |
|---|---|
doorman-vault |
HashiCorp Vault / OpenBao |
doorman-sops |
Mozilla SOPS (encrypted files) |
doorman-bitwarden |
Bitwarden password manager |
Identity Providers¶
| Plugin | Integrates With |
|---|---|
doorman-keycloak |
Keycloak identity server (OAuth2/OIDC tokens) |
Desktop Keystores¶
| Plugin | Integrates With |
|---|---|
doorman-gnomekeyring |
GNOME Keyring (Linux desktop) |
doorman-chrome |
Chrome browser stored passwords |
doorman-chromium |
Chromium browser stored passwords |
doorman-firefox |
Firefox browser stored passwords |
doorman-thunderbird |
Thunderbird stored credentials |
Protocol¶
Doorman plugins follow the standard Plugin Protocol:
# Plugin metadata
doorman-vault info
# {"name": "doorman-vault", "version": "1.0.0", "supports": ["amadla.org/entity/secret@^v1.0.0"], ...}
# Retrieve a secret (entity in via stdin, secret entity out via stdout)
echo '{"_type": "amadla.org/entity/secret@v1.0.0", "_body": {"key": "db_password", "path": "secret/data/myapp"}}' \
| doorman-vault get
Output is always a universal secret entity format, regardless of the backend.
Go Framework (Optional)¶
LibraryDoormanFramework provides convenience wrappers for Go plugin authors:
- Standard secret-fetching interface
- Secret entity output formatting
- Common authentication patterns
Plugins can also be written in any other language — just implement the protocol.
Implementation Priority¶
Suggested implementation order based on ecosystem needs:
- doorman-vault — Most common enterprise secret store
- doorman-aws — Cloud deployments
- doorman-keycloak — Identity/OAuth2 token management
- doorman-sops — Git-friendly encrypted secrets
- Remaining cloud providers and desktop keystores