thakares/nx9-auth
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
6a04d7f7930a1d15f6ff9050492bab0f02b87f59
nx9-auth/README.md
T

8.9 KiB
Raw Blame History

nx9-auth

Enterprise Identity & Access Management (IAM)

Self-Hosted • Privacy-First • Pure Rust • Single Binary • Linux Native

Version Rust License Platform SQLite PostgreSQL

nx9-auth

Enterprise Identity & Access Management (IAM) written entirely in Rust.

Self-hosted • Privacy-first • Linux-native • Single Binary • Multi-Tenant • Open Source

Part of the NX9 ecosystem.

Overview

nx9-auth is a modern Identity & Access Management (IAM) server built entirely in Rust, designed for organizations that require secure, self-hosted authentication and authorization without the complexity of traditional enterprise IAM platforms.

Unlike heavyweight Java-based IAM systems, nx9-auth focuses on:

  • Security first
  • Operational simplicity
  • Low resource usage
  • Fast deployment
  • Modern REST APIs
  • Complete ownership of your data

The project is designed as the authentication foundation for the NX9 ecosystem, while remaining completely independent and reusable for any application.

Dashboard

Features

Identity Management

  • ✅ Multi-Tenant Architecture
  • ✅ User Management
  • ✅ User Profiles
  • ✅ Groups
  • ✅ Role Based Access Control (RBAC)
  • ✅ Fine-grained Permissions
  • ✅ Applications
  • ✅ Service Accounts

Authentication

  • ✅ Username / Password
  • ✅ Session Management
  • ✅ API Tokens
  • ✅ Personal Access Tokens
  • ✅ Password Reset
  • ✅ Secure Cookie Authentication

Security

  • ✅ Argon2id Password Hashing
  • ✅ Session Revocation
  • ✅ Token Revocation
  • ✅ Security Headers
  • ✅ Audit Logging
  • ✅ Rate Limiting
  • ✅ No Plaintext Password Storage
  • ✅ No Plaintext Token Storage
  • ✅ Transaction Rollback Protection

Administration

  • ✅ Dashboard
  • ✅ Audit Viewer
  • ✅ Settings
  • ✅ Tenant Management
  • ✅ Profile Management

Database

  • ✅ SQLite
  • 🚧 PostgreSQL
  • 🚧 MySQL

Screenshots

Login

Dashboard

Roles & Permissions

Roles Permissions

Applications

Applications Create Application

Service Accounts

Sessions

API Tokens

Audit Log

Tenants

Settings

Why nx9-auth?

Traditional Enterprise IAM nx9-auth
Java based Rust
Large memory footprint Lightweight
Complex deployment Single Binary
Multiple services Minimal dependencies
Cloud-first Self-hosted
Vendor lock-in Open Source
Large attack surface Minimal attack surface

Architecture

                Browser

                    │

                    ▼

            Dioxus Web UI (WASM)

                    │

                    ▼

              REST API (Axum)

                    │

                    ▼

          Authentication Layer

                    │

                    ▼

          Authorization (RBAC)

                    │

                    ▼

          Repository Layer

                    │

                    ▼

          Database Provider

                    │

        ┌───────────┴───────────┐
        │                       │
     SQLite                 PostgreSQL
     (Current)               (Planned)

Technology Stack

Component Technology
Language Rust
Backend Axum
Frontend Dioxus
Database SQLite
Async Runtime Tokio
Authentication JWT + Cookies
Password Hashing Argon2id
ORM SQLx
Serialization Serde

Quick Start

Clone the repository

git clone https://github.com/thakares/nx9-auth.git
cd nx9-auth

Build

cargo build --release

Initialize

./target/release/nx9-auth init

Run Setup Wizard

./target/release/nx9-auth setup

Start Server

./target/release/nx9-auth serve

Open

http://localhost:8655

Configuration

Create your local configuration from the example:

cp config.example.toml config.toml

Then edit:

  • Database
  • Server
  • Session
  • Security
  • SMTP
  • Logging

CLI

Command Description
init Initialize project
setup Interactive setup wizard
serve Start server
migrate Run migrations
backup Backup database
restore Restore database
user User management
token API token management

REST API

Endpoint Description
/api/v1/auth Authentication
/api/v1/users Users
/api/v1/groups Groups
/api/v1/roles Roles
/api/v1/permissions Permissions
/api/v1/applications Applications
/api/v1/service-accounts Service Accounts
/api/v1/sessions Sessions
/api/v1/tokens API Tokens
/api/v1/audit Audit Logs
/api/v1/profile Current User
/api/v1/dashboard Dashboard

Docker

docker compose up -d

CasaOS

docker compose -f compose.casaos.yml up -d

Security

Security is a primary design goal.

Implemented features include:

  • Argon2id password hashing
  • Password strength validation
  • Secure session cookies
  • Session revocation
  • API token hashing
  • Audit logging
  • Rate limiting
  • Transaction rollback protection
  • Security headers
  • Authorization middleware
  • RBAC
  • Permission middleware
  • No plaintext passwords
  • No plaintext session tokens
  • No plaintext API tokens

Project Structure

docs/               Documentation
scripts/            Build & release scripts
src/                Backend
tests/              Integration tests
ui/                 Dioxus frontend

src/api             REST API
src/db              Database
src/security        Security
src/middleware      Middleware
src/identity        Identity services
src/config          Configuration

Documentation

Additional documentation is available in the docs/ directory.

  • AUTHENTICATION.md
  • BACKUPS.md
  • BENCHMARKS.md
  • DEPLOYMENT.md
  • DOCKER.md
  • INTEGRATION_BZOD.md

Testing

Run all tests

cargo test

Run Clippy

cargo clippy --workspace --all-targets --all-features -- -D warnings

Run formatter

cargo fmt --all

Current Status

Feature Status
Authentication ✅
RBAC ✅
Sessions ✅
Audit Logs ✅
Applications ✅
Service Accounts ✅
API Tokens ✅
Dashboard ✅
SQLite ✅
PostgreSQL 🚧
OAuth2 🚧
OpenID Connect 🚧
WebAuthn 🚧
MFA 🚧

Roadmap

Version 0.2

  • SQLite
  • REST API
  • Dashboard
  • Multi-Tenant
  • RBAC
  • Sessions
  • Audit Logging

Version 0.3

  • PostgreSQL
  • Repository Improvements

Version 0.4

  • OAuth2
  • OpenID Connect
  • LDAP

Version 0.5

  • WebAuthn
  • Multi-Factor Authentication

Version 1.0

  • Stable Enterprise Release

Philosophy

The NX9 ecosystem follows a simple philosophy:

  • Self-hostable first
  • Linux-native
  • Privacy-first
  • Open Source
  • Minimal dependencies
  • Operational simplicity
  • Single binary where practical
  • No vendor lock-in

Contributing

Contributions are welcome.

Please:

  1. Open an issue before major changes.
  2. Follow Rust formatting (cargo fmt).
  3. Ensure Clippy passes without warnings.
  4. Add tests for new functionality.
  5. Keep documentation up to date.

License

Licensed under the MIT License.

nx9-auth — Secure, self-hosted Identity & Access Management built with Rust.

Part of the NX9 ecosystem.

Reference in new issue View Git Blame Copy Permalink