Vaulthalla Documentation
Vaulthalla is the final cloud: sovereign, encrypted storage on hardware you own. A native C++ daemon encrypts every file before it reaches a disk or a bucket, enforces one set of permissions across the web console, the vh CLI, the S3-compatible gateway and (on Linux) a real filesystem mount, and syncs vaults to S3-compatible providers under cost limits you set. It runs on Linux and on Apple Silicon Macs.
These pages are for the people who install and run it, and the people who use it. Contributor documentation is under Contributors.
Start Here
Linux or macOS
Install Vaulthalla
Choose a platform and install from APT, the macOS installer package, or Homebrew.
First Run
Sign in, secure the generated admin password, confirm CLI access, and create a vault.
HTTPS
Serve the console on a home-network name or a public domain: nginx on Linux, Caddy on macOS.
Your Platform
amd64 · Ubuntu 24.04
Linux
The Debian package, systemd services, TPM2 key sealing, the FUSE mount, PostgreSQL and nginx integration. Install · Administer · Troubleshoot
Apple Silicon · macOS 14+
macOS
The installer package or Homebrew cask, launchd LaunchDaemons, a bundled PostgreSQL and Caddy. Install · Administer · Troubleshoot
Every difference between the two is in Platform Comparison; everything else on this site applies to both.
Daily Operation
Web Console
Files, previews, shares, vaults, users, cost control, health and notifications in the browser.
CLI Guide
vh for status, users, roles, vaults, sync, API keys, secrets, budgets and file transfers.
Vaults
Local and S3/R2 vaults, ownership, permissions, and filesystem access.
Sync
Cache, sync or mirror strategies, dry-runs, S3 Inventory imports and conflict resolution.
Sharing
Public and email-validated share links with expiry, limits and upload policies.
S3 Gateway
Vaults as S3 buckets for the AWS CLI, rclone, MinIO mc, SDKs and backup tools.
Safety And Recovery
Encryption
How master keys are protected on each platform, per-vault AES-256-GCM keys, upstream encryption and rotation.
Backup And Recovery
A recovery set that actually restores: database, state, configuration, key and secret exports.
Cost Control
Request budgets and price budgets that stop S3/R2 work before it runs up a bill.
Administration And Reference
- Users, Groups And Roles, S3 Gateway Administration, Operator Emails.
- Configuration, Runtime Paths, Platform Comparison, Command Reference.
- When something breaks: Linux Troubleshooting, macOS Troubleshooting, then General Troubleshooting for vaults, sync, previews, shares and costs.
What Ships Today
| Area | Status |
|---|---|
| Linux (amd64, APT): daemon, web console, CLI, FUSE mount, TPM2 sealing, nginx integration | Production |
| Encrypted local and S3/R2 vaults, sync, cost controls, RBAC, sharing, S3 gateway | Production, on both platforms |
macOS (Apple Silicon): installer package, Homebrew cask, launchd, bundled PostgreSQL, vh setup caddy | New in this release |
vh fs file transfers over the CLI socket | Interim file access on macOS until a mount ships |
Hardware video encoding in vaulthalla-preview-media | Detected, not yet validated on real GPUs |
| macOS Finder mount, Secure Enclave key sealing, an Apple-signed package | Planned, not shipped |
These docs describe what the installed product does. Anything planned is labeled as such.