Tomas DvorakandDevin
585bb04ab2
Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id → XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:* / inject (primora:// refs) / agent credential broker (dummy tokens in the child, real secret on the wire) / TTL sessions / stack:* operator group. Project vault (backend): core.project_secrets, AES-256-GCM via the platform encryptor. Metadata-only list, audit-logged reveal, and secret://NAME refs resolved at job delivery — refs stored, values never. Surfaces: dashboard Vault page (+ local-vault card under the Tauri shell), desktop vault window via IPC to the primora binary, secrets:* --remote CLI mode, metadata/write-only MCP tools so agents consume secrets via secret:// refs without holding plaintext. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
4.6 KiB
Primora
Self-hosted backend platform for building products.
Auth, Postgres-backed APIs, object storage, and audit logs on your own hardware.
Quick Start · Documentation · Releases · Contributing
What is Primora?
Primora is a self-hosted backend platform: organizations, projects, auth, S3-style object storage, JSON document collections, scoped API keys, and a full audit log behind one dashboard. Inspired by the UX of Appwrite and Supabase, with no hosted tier - your data stays on your hardware.
Screenshots
| Overview | Storage | Telemetry |
|---|---|---|
 |
 |
 |
More screenshots
| Collections | Automation | Audit log |
|---|---|---|
 |
 |
 |
Features
- Organizations & projects - workspaces with scoped org and project roles.
- Auth - email/password plus optional GitHub, Google, Discord, and Microsoft OAuth. JWTs verified by the API against JWKS.
- Storage - S3-style buckets on your local filesystem, public or private.
- Collections - schema-flexible JSON documents in Postgres JSONB.
- API keys -
prm_<prefix>_<secret>credentials, shown once. - Audit log - every mutating request recorded, with CSV/JSON export.
- Demo mode - fully client-side seeded workspace via
?demo=true.
Architecture
Browser ──▶ Nginx ──▶ Frontend (SolidJS + Vite)
├──▶ Auth service (Better Auth + Hono)
└──▶ API (Go + Gin) ──▶ PostgreSQL
──▶ DragonflyDB (Redis-compatible cache)
──▶ Local filesystem object storage
Quick Start
Prerequisites: Docker with the Compose plugin.
curl -fsSL https://raw.githubusercontent.com/Dvorinka/Primora/master/install.sh | bash
Installs into ./primora, generates secrets, and starts the stack on port 80.
Or from a clone:
git clone https://github.com/Dvorinka/Primora.git && cd Primora
./scripts/setup.sh # creates .env, generates secrets, starts the stack
Then open http://localhost - or append ?demo=true to explore a seeded
workspace without signing up. For prebuilt images, native development, port
conflicts, and troubleshooting see QUICK_START.md.
Configuration
All configuration lives in .env - see .env.example for the annotated list
and QUICK_START.md for the important ones.
Ecosystem
- CLI -
primorafor orgs, projects, buckets, objects, keys, jobs, and audit — plus an encrypted local secrets vault (vault:*,secrets:*,inject), the shared project vault (secrets:* --remote,secret://NAMErefs in job payloads), an agent credential broker (agent), and compose-stack operator commands (stack:*). - MCP server - exposes
primora_*tools to MCP clients. - Desktop - Tauri 2 shell connecting to your deployment, with tray presence and a local Secrets Vault window (drives the CLI's vault).
- PWA - the dashboard is installable on mobile and desktop browsers.
Documentation
- QUICK_START.md - setup, configuration, troubleshooting
- project_backend.md / project_frontend.md - original design specs
apps/backend/openapi/openapi.yaml- API contract
Contributing
See CONTRIBUTING.md for the development workflow.
Security
See SECURITY.md for reporting vulnerabilities.