ITHardware, from invoice to disposal
Auto-numbered asset IDs, check-out and check-in against people, maintenance history, uploaded invoices, warranty dates, and a recycle bin for the ones deleted by accident.
ships in one line
Self-hosted
AGPL-3.0
Flask & MariaDB
amd64 & arm64
Know what you own, and who has it.
IT-Vault is an asset register and helpdesk for the person who is the whole IT department. Track hardware from purchase to disposal, print the labels that go on it, chase the contracts that renew, and answer the tickets it generates — on your own server. It brings no database of its own, so the data stays somewhere you already know how to back up.
$ curl -fsSL https://raw.githubusercontent.com/shatheitguy/it-vault/main/install.sh | sh
PS> irm https://raw.githubusercontent.com/shatheitguy/it-vault/main/install.ps1 | iex
Pulls the image, starts it on port 5000, and waits until it really answers before saying it worked. No Docker? It offers to install that too. --dry-run prints the plan and changes nothing.
real output — this is the whole install
Screens
What you actually get.
A dark console built for a stockroom and a helpdesk queue, not a spreadsheet. This is a factory-new install — the theme, layout and branding below are what you see on first run.
// example data on a throwaway install — every asset, name and serial above is invented
Automation
The paperwork does itself.
Handing someone a laptop normally means a form, a signature, a
scan, and a folder nobody can find in a year. In
IT-Vault
it is one email and one signature, and the record files itself.
STEP 01
Assign it
Attach the asset to an employee. They get an email with a single button — no account, no login, no app to install.
STEP 02
They sign
The link opens the asset's details on their phone. They type their name and sign with a finger.
STEP 03
Copies go out
On submit, a signed PDF is emailed to them and to every admin with an address on file. Nobody has to remember to send it.
STEP 04
It's on the record
The asset flips to Checked-Out, and the signature, signer and date stay attached to it — viewable and printable later.
And these run without you
- Uptime monitoring Your devices and services checked around the clock, with one alert when something drops and one when it recovers.
- Contract expiry alerts Renewal dates are watched on a schedule and emailed before they lapse.
- Scheduled backups Archives on a timer, by scope, kept on their own volume.
- LDAP / AD sync Your directory pulled in on a schedule, not by hand.
- Warranty watch Anything falling inside 30 days surfaces on the dashboard on its own.
- Update checks The app notices a new release and installs it in one click.
- Audit trail Every change written down with who did it and when — no opt-in.
// emailing needs SMTP configured in Settings, and an employee with an address on file — the sign page only promises "sent to your inbox" when a copy really went
Database
Bring your own. It stays yours.
IT-Vault ships without a database on purpose. It connects to any MariaDB 10.6+ or MySQL 8+ you already run — bare metal, another container, or a managed instance — and builds its own schema there on first start.
- It never provisions, upgrades or drops your server. Your version, your backup policy, your retention — unchanged by anything the app does.
- The schema migrates itself. Every start brings the tables up to date, so an upgrade needs no manual SQL.
- Point it somewhere else any time. Settings ▸ Database, or the DB_* variables.
- No default password. First run asks for the connection, tests it, then asks you to create the administrator. Nothing can sign in until you do.
Container
IT-Vault
Web app, port 5000. Volumes hold the session key, invoices and backups.
DB_HOST : 3306
Yours
MariaDB / MySQL
Wherever you keep it. IT-Vault only ever reads and writes its own schema.
Register
What it keeps track of.
One place for the things a small IT department is asked about at 4 p.m. on a Friday.
Assets
People
Contracts
Tickets
Directory
Network
Heartbeat
Labels
Access
Data
On the go
Employees and what they signed for
A directory with auto-numbered employee IDs, and an emailed handover link the employee signs without logging in. A signed PDF then goes to them and to every admin automatically.
Renewals that stop surprising you
Licences, support agreements and subscriptions with payment plans; pick a plan and the renewal date fills itself in, still editable when the vendor disagrees.
A helpdesk your staff can actually reach
A public portal for raising and following tickets without an account, SLA timers and automation on the inside, and a live wallboard for the screen on the office wall.
LDAP and Active Directory sync
Pull users straight from your domain controller instead of typing them twice — bind user, base DN, and a sync you can run when you want it.
Find the things nobody wrote down
Scan a subnet of any size, resolve hostnames, and identify each device's maker from its MAC address, then add what you find as assets — or don't.
Know it went down before they tell you
Ping, HTTP, a keyword on the page, a TCP port or a DNS name — checked on their own intervals, around the clock. One email when something drops and one when it comes back, never one per failed check, and a year of uptime you can still ask about.
QR labels, printed to size
Print one label or a whole sheet, with the fields you choose on them. Scanning a label opens that asset; the app's own scanner reads model and serial off a manufacturer's sticker.
Roles down to the module
Build your own roles: this person sees assets only, that one gets tickets and the directory but never Settings. Every change lands in an audit log with who and when.
Backups you can restore, by scope
Export everything, or just configuration, or just assets — an "everything" archive carries the uploaded logo and letterhead too. Restore reverts a scope to that point in time rather than merging.
An Android app for the store cupboard
Scan a barcode or a printed label, edit the asset, get it signed, or print — without walking back to a desk.
Updates
Upgrading is a button.
Settings ▸ General checks the release feed and tells you what changed. This is what it looks like when there's something to install.
↑
v1.7.0 → v1.8.0
A new version of IT-Vault is ready to install.
The installer takes a full backup before it replaces anything — every table, the branding and every invoice attachment, written into the backups volume, so it is in Backup/Restore the moment the app comes back. An update never touches the volumes, so that snapshot is not insurance against the update: it is the copy of “before” that is impossible to reconstruct afterwards.
On a source install the button pulls the new code, installs anything new and restarts, then the page reloads into the new version. A container can't replace itself — that would mean mounting the host's Docker socket into a web app that also takes file uploads and holds your LDAP credentials — so IT-Vault asks Watchtower to do it instead, and the socket stays with a small single-purpose container. Watchtower can also check daily on its own, which makes updates arrive with no clicks at all.
Updating by handdocker run
# 1. get the new image -- this alone changes nothing that's running docker pull ghcr.io/shatheitguy/it-vault:latest # 2. recreate the container. `docker restart` will NOT update it: # a container is bound to the image it was created from. docker rm -f itvault docker run -d --name itvault --restart unless-stopped \ -p 5000:5000 \ -e ITVAULT_DATA_DIR=/app/data \ -e DB_HOST=itvault-db -e DB_NAME=itvault \ -e DB_USER=itvault -e DB_PASS=<your-password> \ -v itvault_data:/app/data \ -v invoices_data:/app/invoices \ -v backups_data:/app/backups \ ghcr.io/shatheitguy/it-vault:latest # 3. confirm what's actually running docker exec itvault cat VERSION
Removing the container is safe. Removing its volumes is
not: itvault_data holds the saved database pointer and the
session key, so keep all three -v flags or you will come
back to the setup wizard. Passing the DB_* values on the
command line is belt and braces — then the connection is declared
in the command itself and can't be lost at all. Forgotten your flags?
docker inspect itvault prints them before you replace it.
Updating with composeTwo commands
docker compose pull docker compose up -d
Compose recreates only what changed and reuses your volumes, so there are no flags to remember. This is the route worth switching to.
Install
One step, database included.
The installer offers to set up MariaDB alongside IT-Vault. It asks
for the database name, username and password, then creates the
network and volume, starts MariaDB, and connects IT-Vault to it
— no setup wizard, no GRANT, no
1045 Access denied. Say no and it points at a database
you already run instead. Linux and macOS today; the Windows
installer starts IT-Vault and lets the browser wizard ask.
IT-Vault + MariaDBOne step
# Linux server -- this is the whole thing curl -fsSL https://raw.githubusercontent.com/shatheitguy/it-vault/main/install.sh | sh # it asks, you answer, it builds: Install MariaDB here and connect IT-Vault to it? [y/N] y Database name [itvault]: itvault Database username [itvault]: itvault Database password [Enter = generate one]: confirm: # then, without being asked again: ==> Creating network 'itvault-net' ==> Creating volume itvault_db ==> Starting MariaDB as 'itvault-db' ==> Waiting for MariaDB to finish initialising ==> Starting container 'itvault' on port 5000 # open http://localhost:5000 and create the admin account. done. # unattended, no questions: curl -fsSL .../install.sh | sh -s -- \ --db-name itvault --db-user itvault --db-pass 'something-long'
One lineBring your own DB
# Linux / macOS curl -fsSL https://raw.githubusercontent.com/shatheitguy/it-vault/main/install.sh | sh # Windows PowerShell irm https://raw.githubusercontent.com/shatheitguy/it-vault/main/install.ps1 | iex # From cmd.exe -- irm and iex are PowerShell, so wrap it powershell -NoProfile -c "irm https://raw.githubusercontent.com/shatheitguy/it-vault/main/install.ps1 | iex" # --no-db skips the database question and uses the browser wizard curl -fsSL .../install.sh | sh -s -- --no-db # Read it first, if you'd rather (and you'd be right to) curl -fsSLO https://raw.githubusercontent.com/shatheitguy/it-vault/main/install.sh less install.sh && sh install.sh --dry-run
UninstallKeeps your data
curl -fsSL https://raw.githubusercontent.com/shatheitguy/it-vault/main/uninstall.sh | sh irm https://raw.githubusercontent.com/shatheitguy/it-vault/main/uninstall.ps1 | iex # removes the container and the image, then tells you what it kept. # your volumes and your database survive unless you ask otherwise: sh uninstall.sh --purge # also delete invoices, backups, session key sh uninstall.sh --purge-db # also delete the itvault-db container + volume
Docker ComposeRecommended for a server
git clone https://github.com/shatheitguy/it-vault.git cd it-vault cp .env.example .env # optional: fill in DB_HOST, DB_USER, DB_PASS docker compose up -d # then open http://localhost:5000 for the setup wizard
The image, directlyamd64 & arm64
docker run -d --name itvault -p 5000:5000 \
-v itvault_data:/app/data \
-v invoices_data:/app/invoices \
-v backups_data:/app/backups \
-e ITVAULT_DATA_DIR=/app/data \
ghcr.io/shatheitguy/it-vault:latest
# latest follows main, so a pull always brings the current build
NAS
Unraid and TrueNAS, without a compose file.
Most homelabs already have the box. On Unraid, IT-Vault is a Community Applications template — ports, the three data paths and the database fields, with an overview that says up front that it brings no database of its own, so you install MariaDB first and point it there. On TrueNAS (24.10 and later, which runs Docker Compose), paste one file into Custom App → Install via YAML; that one does bring MariaDB with it.
Agents
Let an AI run the register.
IT-Vault ships an MCP server, so an agent can do what a person does: find a device, see who has it, assign it, take it back, raise and answer tickets, chase the contracts that are about to lapse. It runs on the agent's side and authenticates with an API key — which means the agent has exactly the permissions of the user that key belongs to, and nothing more. Give a watching agent a read-only key and no amount of prompting changes anything; deleting needs a second switch of its own.
Wiring for Hermes, OpenClaw, ZeroClaw, Claude Desktop, Claude Code and ChatGPT is in the repository.
Android
Your rack, in your pocket.
A native app for assets, tickets, contracts and the directory — with offline-first editing that syncs the moment you're back on the network, QR and barcode scanning, and updates built in. It picks up your server's own name and logo after login, so it wears your branding. No app store required.
Android will warn that the developer is unknown — expected for anything installed outside the Play Store. Tap More details → Install anyway. After that, the app updates itself from Settings → Check for updates.