Skip to main content
The current Core is a standalone native Rust service. It composes identity, OAuth, registry, authorization and product boundaries; the previous Bun API and TypeScript platform applications are archived under legacy/. The browser Console and account screens use React. Their hosting can be composed with Core’s static artifact or configured separately while retaining exact canonical origins.

​
Source and artifacts

Use spitzli/cloud and its pinned toolchains. Root package.json supplies the current commands; Cargo.toml defines the native workspace. apps/console/dist is the built browser artifact, selected through WEBDOCK_UI_DIST for Core’s static serving mode. deploy/docker/Dockerfile has separate core, migrate, bootstrap-operator, agent-control, plugin-control and plugin-controller targets. The backend Dockerfile (deploy/docker/backend.Dockerfile) packages the backend separately from the frontend. Match the artifact and source revision to the deployment being changed. Product runtime images release independently. Publishing a new Core image does not upgrade plugin installations or change customer provider bindings. See independent plugin releases.

​
Runtime configuration

Core uses restricted PostgreSQL roles, verified database TLS, explicit canonical origins and private identity/encryption material. The hosted Core database and encrypted BYOK metadata are on Neon. Neon Managed Auth supplies all users’ first factor; Core retains MFA and local authorization. Do not put migration credentials into runtime processes. Core does not initialize or migrate schemas at startup. Identity keys, RLS keys, encryption keys and retained storage must survive replacement of an image or process. Use feature configuration for native product admission. Provider credentials, runtime enrollment, worker/listener configuration and project grants remain separate requirements. Outgoing-only Mail never provisions an incoming Stalwart instance.

​
Verification and rollout

Follow the matching source revision’s checks and qualified build workflow. A passing compile, image publication or health probe is not acceptance for a new customer flow. Verify migrations, readiness, canonical routing, identity/MFA, tenant access, runtime bindings, retained data and rollback after new writes for the actual change. Blacksmith is the selected provider for Spitzli’s own GitHub CI. Its GitHub App is installed, and an isolated runner/build probe passed in us-west. Full application/plugin/SDK source checks and regular workflow migration remain pending. EU-only placement is not required for this CI scope. Trusted maintainer CI does not qualify arbitrary customer build source or change the other services’ regional requirements. See local development, operator deployment and initial setup. Native runtime contracts live in crates/control-plane; some README migration notes describe earlier intermediate states.