Configuration records for equipment that never touches the network.
Ferrocodex keeps PLC and HMI configurations, firmware, and equipment credentials in one encrypted database on a single workstation. No server, no account, no connection required.
| Version | Change | By | Status |
|---|---|---|---|
| v1 | Commissioning baseline2 Mar 2026 | M. Okafor | Archived |
| v2 | Infeed photoeye timing14 May 2026 | M. Okafor | Approved |
| v2.1 | Branch: jam recovery21 Aug 2026 | R. Lindqvist | Silver |
| v3 | Jam recovery sequence30 Sep 2026 | R. Lindqvist | Golden |
465fdc27 8a3e
Encrypted at rest
Promoted by admin, 30 Sep 2026
Built for the air gap
Nothing leaves the workstation
Ferrocodex makes no network calls. Data lives in a SQLite database in the local application data folder, and the app works the same on a plant-floor laptop that has never seen the internet.
Secrets are encrypted before they are stored
Configuration content, firmware files, and vault credentials are encrypted with AES-256-GCM. Keys are derived from the signed-in user's credentials, so there is no master key sitting on disk.
Every change is on the record
Each upload, status change, credential access, and login is written to an audit log. Administrators can see who changed what, and when, for any device.
What it keeps
One record per device, with everything you would need to put it back into service after a failure.
- Configurations
- Upload a configuration file and keep every version. Branch to try a change while the golden version stays untouched, then promote the version that works.
- Firmware
- Store firmware images next to the configurations they belong to, with SHA-256 integrity checks and the same draft, approved, and golden statuses.
- Credentials
- An identity vault for equipment passwords, with rotation history and per-user access. The password you typed is the one that gets stored, and nobody else can read it without their own login.
- Asset hierarchy
- Organise sites, lines, and devices in a tree. Drag to reorganise, search by name or type, and import, export, or rename in bulk.
- Metadata
- Define the fields that matter at your site, such as IP address, rack slot, or maintenance contact, with JSON Schema validation and reusable templates.
- Recovery packages
- Export the golden configuration and firmware for a device as one bundle. Import it on another workstation to restore the device.
How a change becomes golden
-
Upload the running configuration
Pull the configuration from the device and add it as a new version. It starts as a draft.
Draft -
Branch to try a change
Work on a branch while the current golden version stays available. Promote the branch when it holds up on the equipment.
Silver -
Approve it
An administrator reviews the version and the notes, then approves it for production use.
Approved -
Promote to golden
The approved version becomes the one you restore from. The previous golden stays in history, and the audit log records who promoted it.
Golden
What is encrypted, and what is not
Ferrocodex encrypts the data that would hurt if it leaked, and says so plainly about the rest. Protect the application data folder with operating system permissions and full-disk encryption.
Encrypted before it is stored
- Configuration file content
- Firmware files on disk
- Vault credentials
- User passwords, stored as bcrypt hashes
Stored in plain text
- Asset names and the hierarchy
- Metadata field values
- Version notes and status history
- Audit log entries
Access control
Two roles. Administrators manage users, review audit logs, and approve versions. Engineers manage assets, configurations, and firmware. Logins are rate limited and sessions expire. Vault credentials are shared per user, not per role.
Download
Version 0.5.2. Every file is built by GitHub Actions from the tagged source and published on the GitHub release.
Linux
- AppImage 85 MB
- Debian and Ubuntu (.deb) 11 MB
- Fedora and RHEL (.rpm) 11 MB
x86-64 with WebKitGTK 4.1, for example Ubuntu 22.04 or later.
The installers are not yet code-signed. Windows SmartScreen and macOS Gatekeeper will ask you to confirm the first launch. On macOS, right-click the app and choose Open.
Prefer to build it yourself? The README lists the prerequisites and the build command for each platform.