nx9-auth is a production-grade, self-hosted Identity & Access Management (IAM) server built entirely in Rust. It provides multi-tenant user authentication, Role-Based Access Control (RBAC), Personal Access Tokens (PATs), OAuth2 service accounts, active session management, full audit logging, an enterprise graceful shutdown runtime lifecycle, and an embedded WebAssembly (WASM) administrative UI.

nx9-auth compiles into a single standalone binary containing both the Axum REST API backend and the embedded Dioxus WASM frontend, backed by a database-agnostic provider supporting both SQLite and PostgreSQL.

Key Features

Unified Enterprise Runtime Lifecycle: Atomic 8-state lifecycle machine (Initializing → Starting → Running → Draining → StoppingWorkers → ExecutingHooks → ClosingResources → Stopped), CancellationToken propagation, JoinSet worker management, prioritized shutdown hooks, and destructor-safe Unix signal escalation.
Dual Database Engine: Native support for SQLite and enterprise PostgreSQL with 100% repository parity and runtime connection pool ownership.
Enterprise Security Model: Argon2id password hashing, BLAKE3 token/session hashing, rate-limiting, CSP, HSTS, and non-enumerating authentication.
Multi-Tenant & RBAC: Tenant isolation, fine-grained permission matrix, role assignments, and organizational user groups.
Personal Access Tokens & Service Accounts: Machine-to-machine authentication with automatic prefix tracking and instant revocation.
Embedded WebAssembly UI: Dioxus-powered administration dashboard with #boot-loader lifecycle management.
Comprehensive CLI Tooling: Automated init, doctor, migrate, backup, restore, and user management commands.

Quickstart

# Initialize application directory, configuration, and default administrator
nx9-auth init

# Verify installation & system health
nx9-auth doctor

# Start server
nx9-auth serve

Configuration

Configure config.toml or set environment variables:

[server]
host = "127.0.0.1"
port = 8655
production = false
cookie_secure = false

[database]
# SQLite URL or file path:
url = "sqlite://./data/auth.db?mode=rwc"

# Or enterprise PostgreSQL:
# url = "postgres://user:password@localhost:5432/nx9auth"

max_connections = 20
min_connections = 5
connect_timeout_secs = 10
idle_timeout_secs = 600
max_lifetime_secs = 1800

[shutdown]
graceful_timeout_secs = 30
force_timeout_secs = 35

Documentation Index

License

Dual-licensed under either of:

Apache License, Version 2.0 (LICENSE or http://www.apache.org/licenses/LICENSE-2.0)
MIT License (LICENSE or http://opensource.org/licenses/MIT)

at your option.

A lightweight Identity and Access Management (IAM) service for the NX9 ecosystem. Built with Rust, Axum, SQLite, and modern security practices, nx9-auth provides authentication, authorization, session management, personal access tokens, audit logging, and role-based access control in a single deployable binary.

https://bzo.in/p/!nx9-auth-arch

Readme

7.3 MiB

0 Stars 1 Watchers 0 Forks