THE HIDDEN DOOR / NEBULA

A fortified home.
For your digital life.

Four open-source tools for reading, writing, marking up, and keeping what matters. Files on your terms. Keys in your hands.

NO REQUIRED APP SUBSCRIPTION NO TRACKING ON THIS SITE

Build a home. Keep the keys.

READ / CREATE / ANNOTATE / PROTECT

FOUR PILLARS. ONE WAY OF THINKING.

A place for everything.
A boundary around it.

Useful on their own.
Better when your tools
work together.

Screenshots show the actual apps with sample data. See each repository for the current build, setup, and supported features.

THE ARCHITECTURE OF OWNERSHIP

A home.
Not a lease.

Your tools should still be useful when you close the tab, stop paying for an app, or disconnect the cable.

Understand the boundaries
01

Own the work.

Markdown is plain text. Image exports are ordinary files. Public source lets you inspect, build, and keep the tools you use.

02

Take it offline.

Local writing and image work stay on your machine. Cache web pages before disconnecting. Vault credentials have an encrypted offline cache.

03

Encrypt before upload.

Your Vault encrypts records and file attachments locally. Google Cloud stores the encrypted copies; your master password unlocks the Vault.

04

Let the web be text.

The reader converts HTML to Markdown. Site JavaScript stays out of the reading view. This homepage also runs without JavaScript, analytics, or third-party assets.

STRONG BOUNDARIES. PLAIN LANGUAGE.

Know what’s inside.
Know what connects.

Offline is a capability. An air gap is a choice.

You can disconnect for local writing, image work, cached web reading, and cached credential access. Browsing new pages and cloud sync need a connection. Nebula does not automatically create an air gap or isolate your operating system. Vault attachments currently require an online unlock to open and save.

No required app subscription. Storage has a cost.

The four tools have public source under their respective licenses and no required app subscription. Vault setup uses your own Google Cloud project: Secret Manager for encrypted records and an optional GCS bucket for encrypted files. Provider storage, requests, and network charges can apply. The apps are self-built development tools, with setup instructions in their repositories.

Your keys need a recovery plan.

Keep your Vault recovery code protected and separate. Encrypted Vault backups include attachment references and key material, not the file objects themselves. Retain the referenced bucket objects as well. An unlocked Vault cannot protect you from a compromised operating-system user session.

No scripts in the reader. Real limits on the web.

The reader fetches HTTPS content and sitemaps, converts it to Markdown, and renders without page JavaScript or embedded images. JavaScript-only pages can be incomplete. Forms, authenticated web sessions, PDFs, and media are outside this reader’s scope. No-script reading reduces what a page can run; it is not a promise of immunity from every vulnerability.

INSPECT IT. BUILD IT. MAKE IT YOURS.

The door is open.
The keys are yours.

Start with one tool.
Build a home around the way you work.

A more readable web starts with a sitemap. Visit the public directory