Why I Built Loom Vault

I wanted a notes app where I control the encryption keys AND the storage. Not another Notion clone that syncs my private notes to someone else's S3 bucket. Not a password manager that phones home. I wanted something I could deploy on my homelab, behind my own network, with a single master PIN and no user management nonsense. So I built Loom Vault, a private knowledge base and secrets manager that lives on my Proxmox server and talks to my own PostgreSQL and MinIO instances.

How I Built It

Loom Vault is a Next.js 16 App Router application with a dark amber-on-zinc UI. There is no user registration flow because it is designed for exactly one person: me. On first launch it prompts for a 6-digit master PIN, which gets hashed with PBKDF2 (SHA-512, 100k iterations) and salted. Sessions use AES-256-GCM encrypted tokens stored in httpOnly cookies, good for two hours.

The app has three main sections. The notes system is a full markdown editor with write/preview/split panes, synchronized scrolling, auto-save, folder organization, pinning, and tagging. Images pasted or dragged into the editor stream to MinIO (S3-compatible object storage) through a Next.js API route that verifies the session before uploading. When you remove an image from a note, the corresponding S3 object gets cleaned up automatically.

The secrets manager is where things get interesting. Key-value pairs are encrypted at rest using PostgreSQL's pgcrypto extension (pgp_sym_encrypt) with a server-side key, stored in a bytea column. To support managing multiple apps and homelab services without key collisions (e.g. having a DATABASE_URL for App A and App B), I refactored secrets to be scoped to SecretGroup project folders via a compound unique index: @@unique([key, groupId]).

I built a Prisma client extension that wraps the raw SQL so server-side actions call prisma.secret.createEncrypted() like a normal ORM call, while the database executes a parameterized pgp_sym_encrypt query.

The UI features two modes:

- Visual Card View: Includes eye obfuscation toggles (••••••••), explicit edit lock/unlock states to prevent accidental edits, and one-click copy buttons (Copy Value or Copy KEY=VALUE).

- Scoped Developer View: Switch to Developer View inside any folder tab to edit a raw KEY=VALUE text block. A custom server action (syncSecretsAction) parses the block, diffs it against secrets within that specific folder scope, and executes atomic pgcrypto inserts, updates, or deletes.

// Prisma client extension for encrypted secrets using PostgreSQL pgcrypto
export const prisma = prismaClient.$extends({
  model: {
    secret: {
      async createEncrypted(data: { key: string; value: string; groupId?: string | null; description?: string }) {
        const encryptionKey = process.env.ENCRYPTION_KEY;
        if (!encryptionKey) throw new Error('ENCRYPTION_KEY environment variable is not defined.');

        await prismaClient.$executeRaw`
          INSERT INTO "secrets" ("id", "key", "encrypted_value", "description", "group_id", "created_at", "updated_at")
          VALUES (
            uuidv7(), 
            ${data.key}, 
            pgp_sym_encrypt(${data.value}::text, ${encryptionKey}::text), 
            ${data.description || null}, 
            ${data.groupId || null}::uuid, 
            NOW(), 
            NOW()
          )
        `;
      },
    },
  },
});

The third section is configuration guides, a YAML/JSON editor with syntax highlighting via Prism.js. These are plain text and not encrypted, meant for docker-compose files, nginx configs, and similar operational reference material.

Everything is searchable through a single full-text search bar (Ctrl+K) that queries PostgreSQL tsvector indexes across notes, secret keys/descriptions, and config guides with relevance ranking. Clicking a search result automatically navigates directly to the target folder tab and highlights the matching secret card. The dashboard shows live connection status for both PostgreSQL and MinIO, vault distribution metrics, pinned shortcuts, and a tag cloud.

What I Learned

This was my first real dive into database-level encryption. Using pgcrypto means encryption happens inside PostgreSQL rather than application code—a strength (the app never touches plaintext outside one env var reference) and a constraint (the encryption key lives in an env var on the host server). For a single-user homelab setup, this trade-off makes sense.

The Prisma extension pattern for wrapping raw SQL was a neat trick I will reuse. Refactoring the schema for compound unique keys (@@unique([key, groupId])) taught me how to handle multi-project variable scoping cleanly without cluttering the UI. Also, using PostgreSQL 18 uuidv7() primary keys everywhere gave time-ordered B-tree indexing performance out of the box.