hyperion-vault

Encrypted secrets vault for PostgreSQL (KMS envelope encryption + REST API + automatic rotation). This is its Debian/Ubuntu apt repository.

Install

curl -fsSL https://hyperiondb.github.io/hyperion-vault/install.sh | sudo bash
sudo apt-get install -y postgresql-18-hyperion-vault

Then enable it (alongside pg_replica):

sudo sed -i "s/^#\?shared_preload_libraries.*/shared_preload_libraries = 'pg_replica,hyperion_vault'/" \
  /etc/postgresql/18/main/postgresql.conf
sudo systemctl restart postgresql

CREATE EXTENSION hyperion_vault;
SELECT vault.grant_service_role('vault_service');

The REST API binary is installed at /usr/bin/hyperion-vault-api; run it under systemd on each node, configured via VAULT_* environment variables.

Source & docs: github.com/hyperiondb/hyperion-vault