browser
Next.js frontend
FastAPI backend
LXD / Incus / MicroCloud cluster
REST + WEBSOCKET ON mTLS
PostgreSQL
STATE · METRICS HISTORY · AUDIT
Redis
CACHED CLUSTER READS, ENCRYPTED
Authentik
TOKEN VALIDATION
Vault
CLUSTER CERTIFICATES · USER KEYS
frontend and backend stdout
Fluent Bit
OpenSearch
OpenSearch Dashboards
ACCESS · AUDIT · OVERVIEW
Frontend
Next.js 15, React 18, Tailwind CSS, Radix UI
Backend
FastAPI, Python 3.12, async SQLAlchemy, Alembic
Database
PostgreSQL 17
Cache
Redis 8, LRU eviction, values encrypted with Fernet
Identity
Authentik OAuth2 and OIDC, NextAuth 5, JWT validated against JWKS
Secrets
HashiCorp Vault, PKI and cluster certificates
Logging
Fluent Bit sidecar to OpenSearch
Managed infrastructure
LXD, Incus, MicroCloud over REST and WebSocket on mTLS
Deployment
Docker, separate development and production compose files
IN PRODUCTION
Authentik, Vault and OpenSearch run as separate hosts.
The full multi-host topology belongs in the documentation rather than on a marketing page.
docs.orcastra.io →