mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Tomas DvorakandDevin
585bb04ab2
Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id → XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:* / inject (primora:// refs) / agent credential broker (dummy tokens in the child, real secret on the wire) / TTL sessions / stack:* operator group. Project vault (backend): core.project_secrets, AES-256-GCM via the platform encryptor. Metadata-only list, audit-logged reveal, and secret://NAME refs resolved at job delivery — refs stored, values never. Surfaces: dashboard Vault page (+ local-vault card under the Tauri shell), desktop vault window via IPC to the primora binary, secrets:* --remote CLI mode, metadata/write-only MCP tools so agents consume secrets via secret:// refs without holding plaintext. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
116 lines
4.6 KiB
Markdown
116 lines
4.6 KiB
Markdown
<p align="center">
|
|
<img src="./primora.svg" alt="Primora" width="120">
|
|
</p>
|
|
|
|
<h1 align="center">Primora</h1>
|
|
|
|
<p align="center">
|
|
Self-hosted backend platform for building products.<br>
|
|
Auth, Postgres-backed APIs, object storage, and audit logs on your own hardware.
|
|
</p>
|
|
|
|
<p align="center">
|
|
<a href="#quick-start">Quick Start</a> ·
|
|
<a href="QUICK_START.md">Documentation</a> ·
|
|
<a href="https://github.com/Dvorinka/Primora/releases">Releases</a> ·
|
|
<a href="CONTRIBUTING.md">Contributing</a>
|
|
</p>
|
|
|
|
<p align="center">
|
|
<a href="https://github.com/Dvorinka/Primora/actions/workflows/ci.yml"><img src="https://github.com/Dvorinka/Primora/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
|
|
<a href="https://github.com/Dvorinka/Primora/releases"><img src="https://img.shields.io/github/v/release/Dvorinka/Primora" alt="Release"></a>
|
|
<a href="LICENSE"><img src="https://img.shields.io/github/license/Dvorinka/Primora" alt="License"></a>
|
|
</p>
|
|
|
|
## What is Primora?
|
|
|
|
Primora is a self-hosted backend platform: organizations, projects, auth,
|
|
S3-style object storage, JSON document collections, scoped API keys, and a
|
|
full audit log behind one dashboard. Inspired by the UX of Appwrite and
|
|
Supabase, with no hosted tier - your data stays on your hardware.
|
|
|
|
## Screenshots
|
|
|
|
| Overview | Storage | Telemetry |
|
|
|:-:|:-:|:-:|
|
|
|  |  |  |
|
|
|
|
<details>
|
|
<summary>More screenshots</summary>
|
|
|
|
| Collections | Automation | Audit log |
|
|
|:-:|:-:|:-:|
|
|
|  |  |  |
|
|
|
|
</details>
|
|
|
|
## Features
|
|
|
|
- **Organizations & projects** - workspaces with scoped org and project roles.
|
|
- **Auth** - email/password plus optional GitHub, Google, Discord, and Microsoft OAuth. JWTs verified by the API against JWKS.
|
|
- **Storage** - S3-style buckets on your local filesystem, public or private.
|
|
- **Collections** - schema-flexible JSON documents in Postgres JSONB.
|
|
- **API keys** - `prm_<prefix>_<secret>` credentials, shown once.
|
|
- **Audit log** - every mutating request recorded, with CSV/JSON export.
|
|
- **Demo mode** - fully client-side seeded workspace via `?demo=true`.
|
|
|
|
## Architecture
|
|
|
|
```
|
|
Browser ──▶ Nginx ──▶ Frontend (SolidJS + Vite)
|
|
├──▶ Auth service (Better Auth + Hono)
|
|
└──▶ API (Go + Gin) ──▶ PostgreSQL
|
|
──▶ DragonflyDB (Redis-compatible cache)
|
|
──▶ Local filesystem object storage
|
|
```
|
|
|
|
## Quick Start
|
|
|
|
Prerequisites: Docker with the Compose plugin.
|
|
|
|
```bash
|
|
curl -fsSL https://raw.githubusercontent.com/Dvorinka/Primora/master/install.sh | bash
|
|
```
|
|
|
|
Installs into `./primora`, generates secrets, and starts the stack on port 80.
|
|
Or from a clone:
|
|
|
|
```bash
|
|
git clone https://github.com/Dvorinka/Primora.git && cd Primora
|
|
./scripts/setup.sh # creates .env, generates secrets, starts the stack
|
|
```
|
|
|
|
Then open `http://localhost` - or append `?demo=true` to explore a seeded
|
|
workspace without signing up. For prebuilt images, native development, port
|
|
conflicts, and troubleshooting see [QUICK_START.md](QUICK_START.md).
|
|
|
|
## Configuration
|
|
|
|
All configuration lives in `.env` - see `.env.example` for the annotated list
|
|
and [QUICK_START.md](QUICK_START.md#configuration) for the important ones.
|
|
|
|
## Ecosystem
|
|
|
|
- **[CLI](apps/cli)** - `primora` for orgs, projects, buckets, objects, keys, jobs, and audit — plus an encrypted local secrets vault (`vault:*`, `secrets:*`, `inject`), the shared project vault (`secrets:* --remote`, `secret://NAME` refs in job payloads), an agent credential broker (`agent`), and compose-stack operator commands (`stack:*`).
|
|
- **[MCP server](apps/mcp)** - exposes `primora_*` tools to MCP clients.
|
|
- **[Desktop](apps/desktop)** - Tauri 2 shell connecting to your deployment, with tray presence and a local Secrets Vault window (drives the CLI's vault).
|
|
- **PWA** - the dashboard is installable on mobile and desktop browsers.
|
|
|
|
## Documentation
|
|
|
|
- [QUICK_START.md](QUICK_START.md) - setup, configuration, troubleshooting
|
|
- [project_backend.md](project_backend.md) / [project_frontend.md](project_frontend.md) - original design specs
|
|
- `apps/backend/openapi/openapi.yaml` - API contract
|
|
|
|
## Contributing
|
|
|
|
See [CONTRIBUTING.md](CONTRIBUTING.md) for the development workflow.
|
|
|
|
## Security
|
|
|
|
See [SECURITY.md](SECURITY.md) for reporting vulnerabilities.
|
|
|
|
## License
|
|
|
|
[MIT](LICENSE)
|