#A001CREATEDlaptop · MacBook Pro 16"
#A001ASSIGNEDana.r
#A001RETURNEDoffboarding · wiped
#A001ASSIGNEDmarco.v
#A001ASSIGNEDjoaquin// the very first one
Self-hosted IT asset & access management
If it happened to your hardware, it's in here. Forever.
lazyit is the system of record for the five-person team that runs everything — inventory, access, secrets, knowledge. Append-only history, soft-deletes, no telemetry, AGPL. Nothing quietly disappears.
git clone https://github.com/joacominatel/lazyit && cd lazyit./infra/start.sh- AGPL-3.0
- Self-hosted
- No telemetry
- v1.6.0 · released Jul 5, 2026
One asset. Its whole life, on the record.
Every line is an event that actually happened — created, assigned, returned, reassigned. Append-only, top to bottom. You can read off exactly who had what, and when, without trusting anyone's memory.
Spreadsheets lie by omission. Ledgers don't.
What can't disappear.
Three properties baked into the data model — not settings you remember to switch on.
Append-only
Every change is a new line, never an edit in place. The past stays exactly as it happened.
Soft-delete
Retire isn't erase. Offboard a person, decommission a laptop — the record stays on file.
No telemetry
It never phones home. No tracking, no per-seat billing. Your data lives on your servers and stays yours.
Don't take my word for it. Watch it work.
Two parts of the record, doing their job — real screens from a running instance, not diagrams.
When db-primary dies, you already know what dies with it.
The server stores a shape it can't open. No master key, no back door.
Zero-knowledge. The server never holds the key — so it can't leak what it can't read.
Secrets are encrypted in your browser before they ever reach lazyit. What lands on the server is a shape it can't open: no master key, no back door, nothing an admin or a backup could ever hand over.
Stamped, not promised — check the source. It's AGPL.
How it works →Production secrets
12 items · 4 members
- DATABASE_URL••••••••
- STRIPE_SECRET_KEY••••••••
- ZITADEL_SA_KEY••••••••
The server can never decrypt your secrets.
Everything else is on the same record.
One system, one timeline. Here's the rest of what lives in it — read off the line you came for.
- InventoryEvery asset, with its whole history attached.
- Applications & accessWho can reach what — granted, dated, revocable.
- Access automationOffboarding, reviews and provisioning fire on grant and revoke.
- ConsumablesStock that warns you before it runs out.
- Knowledge baseRunbooks and docs, versioned beside the assets.
- Users & permissionsThree roles, least-privilege by default, full offboarding.
- Global searchOne ⌘K spans every asset, person and runbook.
The boring part, on the record.
What you actually run, and how it comes up — no moving parts you didn't ask for.
- Stack
- Caddy · Next.js · NestJS · PostgreSQL · Valkey · MeilisearchA one-shot migrate step and a nightly backup sidecar ride along. Zitadel comes up only if you choose AUTH_MODE=oidc — local accounts are the default.
- Bootstrap
- One guided script: it detects your host, asks about six questions, writes real secrets, brings the stack up, and points you at /setup.
./infra/start.sh - License
- AGPL-3.0 · single-org · no telemetry · no external services
I built lazyit because I was the IT team, and the spreadsheet was killing me.
No procurement, no committee — just one person tired of guessing who had which laptop. So I wrote down the thing I wished I'd had: a record that doesn't lie, on hardware I control.
It's built in the open and AGPL-licensed. If I disappear tomorrow, you still have the code and your data. You're never stranded.
Put it on the record.
One command, on your own servers. No account, no trial, no telemetry.
docker compose up