Docs
Auth & security
Organizations, roles, capabilities, 2FA, audit, and encrypted secrets.
Accounts
- Email/password via better-auth
- First user via /setup — public /register is disabled afterward
- Optional TOTP 2FA; org-wide require-2FA gate
- API keys for CLI / CI / MCP
Roles & capabilities
- Roles: viewer < member < deployer < admin < owner
- 25 capability overlays (projects, secrets, domains, backups, gitops, AI, docker, …)
- Invite members; set per-member capability grants
Hardening
- Secrets in encrypted columns (AES, ENCRYPTION_KEY)
- Audit log for meaningful mutations
- Basic-auth middleware on applications
- Compose safety checks (no docker.sock binds, no privileged by tenants)
Also see the repository guides under docs/ · REST API reference