108 lines
3.8 KiB
Markdown
108 lines
3.8 KiB
Markdown
# nx9-auth
|
|
|
|
<p align="center">
|
|
|
|
**Enterprise Identity & Access Management (IAM)**
|
|
|
|
*Self-Hosted • Privacy-First • Pure Rust • Single Binary • Dual Database Engine*
|
|
|
|
[]()
|
|
[](https://www.rust-lang.org/)
|
|
[](LICENSE)
|
|
[]()
|
|
[]()
|
|
[]()
|
|
|
|
</p>
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
**nx9-auth** is a production-grade, self-hosted Identity & Access Management (IAM) server built entirely in **Rust**. It provides multi-tenant user authentication, Role-Based Access Control (RBAC), Personal Access Tokens (PATs), OAuth2 service accounts, active session management, full audit logging, an enterprise graceful shutdown runtime lifecycle, and an embedded WebAssembly (WASM) administrative UI.
|
|
|
|
`nx9-auth` compiles into a single standalone binary containing both the Axum REST API backend and the embedded Dioxus WASM frontend, backed by a database-agnostic provider supporting both **SQLite** and **PostgreSQL**.
|
|
|
|
---
|
|
|
|
## Key Features
|
|
|
|
- **Unified Enterprise Runtime Lifecycle**: Atomic 8-state lifecycle machine (`Initializing` → `Starting` → `Running` → `Draining` → `StoppingWorkers` → `ExecutingHooks` → `ClosingResources` → `Stopped`), `CancellationToken` propagation, `JoinSet` worker management, prioritized shutdown hooks, and destructor-safe Unix signal escalation.
|
|
- **Dual Database Engine**: Native support for SQLite and enterprise PostgreSQL with 100% repository parity and runtime connection pool ownership.
|
|
- **Enterprise Security Model**: Argon2id password hashing, BLAKE3 token/session hashing, rate-limiting, CSP, HSTS, and non-enumerating authentication.
|
|
- **Multi-Tenant & RBAC**: Tenant isolation, fine-grained permission matrix, role assignments, and organizational user groups.
|
|
- **Personal Access Tokens & Service Accounts**: Machine-to-machine authentication with automatic prefix tracking and instant revocation.
|
|
- **Embedded WebAssembly UI**: Dioxus-powered administration dashboard with `#boot-loader` lifecycle management.
|
|
- **Comprehensive CLI Tooling**: Automated `init`, `doctor`, `migrate`, `backup`, `restore`, and user management commands.
|
|
|
|
---
|
|
|
|
## Quickstart
|
|
|
|
```bash
|
|
# Initialize application directory, configuration, and default administrator
|
|
nx9-auth init
|
|
|
|
# Verify installation & system health
|
|
nx9-auth doctor
|
|
|
|
# Start server
|
|
nx9-auth serve
|
|
```
|
|
|
|
---
|
|
|
|
## Configuration
|
|
|
|
Configure `config.toml` or set environment variables:
|
|
|
|
```toml
|
|
[server]
|
|
host = "127.0.0.1"
|
|
port = 8655
|
|
production = false
|
|
cookie_secure = false
|
|
|
|
[database]
|
|
# SQLite URL or file path:
|
|
url = "sqlite://./data/auth.db?mode=rwc"
|
|
|
|
# Or enterprise PostgreSQL:
|
|
# url = "postgres://user:password@localhost:5432/nx9auth"
|
|
|
|
max_connections = 20
|
|
min_connections = 5
|
|
connect_timeout_secs = 10
|
|
idle_timeout_secs = 600
|
|
max_lifetime_secs = 1800
|
|
|
|
[shutdown]
|
|
graceful_timeout_secs = 30
|
|
force_timeout_secs = 35
|
|
```
|
|
|
|
---
|
|
|
|
## Documentation Index
|
|
|
|
- [Runtime Lifecycle & Graceful Shutdown](docs/runtime-lifecycle.md)
|
|
- [Release Notes](RELEASE_NOTES.md)
|
|
- [Authentication Model](docs/AUTHENTICATION.md)
|
|
- [Backup & Disaster Recovery](docs/BACKUPS.md)
|
|
- [Docker Deployment Guide](docs/DOCKER.md)
|
|
- [Linux Deployment Guide](docs/DEPLOYMENT.md)
|
|
- [Integration Guide](docs/INTEGRATION_BZOD.md)
|
|
- [Performance Benchmarks](docs/BENCHMARKS.md)
|
|
- [Changelog](CHANGELOG.md)
|
|
- [License](LICENSE)
|
|
|
|
---
|
|
|
|
## License
|
|
|
|
Dual-licensed under either of:
|
|
- Apache License, Version 2.0 ([LICENSE](LICENSE) or http://www.apache.org/licenses/LICENSE-2.0)
|
|
- MIT License ([LICENSE](LICENSE) or http://opensource.org/licenses/MIT)
|
|
|
|
at your option.
|