Grafana Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be cost-effective and easy to operate by indexing only log metadata (labels) rather than the log contents. The system consists of several loosely coupled services (distributor, ingester, querier, compactor, ruler) that can be deployed in a monolithic or microservices architecture. Logs are ingested via various protocols (HTTP, gRPC, Kafka) and integrations (fluent-bit, fluentd, logstash, Docker driver), stored in chunk format in object stores, and indexed by labels in a separate store. Queries are executed using LogQL, which allows filtering by label expressions and log content. The system includes a ruler for alerting and recording rules, a compactor for storage optimization, and a Kubernetes operator for deployment and management.
This is a Laravel package that provides a robust, extensible system for storing and retrieving application settings in a database. It supports multiple drivers (database, Eloquent), caching with configurable TTL, encryption of sensitive values, team/multi-tenancy scoping, and contextual settings via a Context object. The architecture is clean: a main Settings service class uses traits for cross-cutting concerns (caching, encryption, teams, context, serializers) and delegates persistence to pluggable drivers. Key generators and value/context serializers are also pluggable via contracts. The package includes a facade, helper function, and model trait for easy integration. It is actively maintained, supports Laravel 12/13 and PHP 8.2-8.5, and has comprehensive test coverage. The code demonstrates good software engineering practices with clear interfaces, separation of concerns, and extensibility.
SaaStart is a B2B SaaS starter kit built with Next.js and Auth0 that provides multi-tenancy organization management, user authentication/authorization, self-service SSO configuration (OIDC and SAML), security policy management (including MFA), user profile and security settings, and SCIM provisioning capabilities. The application follows a modern Next.js App Router architecture with server and client components, uses Auth0 for identity management, and implements role-based access control with admin/member roles. Key features include organization creation and switching, user invitation workflows, domain verification for SSO, and comprehensive dashboard for managing organization settings, members, and connections.
Hanko is a production-grade, self-hostable authentication and identity platform written primarily in Go. The backend exposes public, admin, and management HTTP APIs plus a CLI for migrations, user import/export, JWK/JWT management, and config schema generation. Authentication is implemented as a custom state-machine engine (flowpilot) driving login, registration, password/passkey/MFA/third-party OAuth/SAML flows, backed by JWT sessions, device trust, webhooks, audit logs, and rate limiting. The persistence layer uses gobuffalo/pop with a broad set of per-entity persister interfaces and roughly 65 Fizz migrations covering users, emails, credentials, sessions, tenants, organizations, roles, SAML providers, and webhooks. The frontend is split into a TypeScript SDK (`@teamhanko/hanko-frontend-sdk`) and Preact-based web components (`@teamhanko/hanko-elements`) that render flow states into embeddable `<hanko-auth>` and `<hanko-profile>` elements. The repository also contains a quickstart Go server, framework examples for React, Vue, Angular, Next.js, and Express, Playwright e2e tests, Docker Compose stacks, and Kubernetes manifests. Data flows through Echo routers into flowpilot actions/hooks, which validate inputs, persist state, issue sessions, and trigger webhook events; PostgreSQL, Redis, SMTP, and external OAuth/SAML providers are the primary external dependencies. Overall the codebase is well-structured and heavily tested, with sophisticated security handling around redirect validation, account linking, multi-tenant isolation, and webhook signing. The main friction points are the custom flowpilot framework's learning curve, a very large configuration surface, duplicated example code, and some stale example/e2e toolchains relative to the core Go and Node versions.
SeekStorm is a high-performance search engine library and multi-tenancy server implemented in Rust. It provides both lexical (BM25F with proximity) and vector (ANN with IVF clustering and scalar/Turbo quantization) search capabilities, supporting real-time indexing, faceted search, spelling correction, query auto-completion, highlighting, and hybrid result fusion via RRF. The architecture consists of a core library (`seekstorm`), a RESTful server (`seekstorm_server`) with embedded web UI, and a Rust client SDK (`seekstorm_client`). The server uses memory-mapped files for persistence, supports per-index configuration of tokenizers, stemmers, stop words, and compression, and enforces multi-tenant isolation via API keys with resource quotas. Search performance is enhanced with SIMD acceleration (AVX2/NEON) for posting list intersection, vector quantization, and distance computations. The codebase is well-tested with extensive integration and consistency tests, and follows an explicit commit model for durability.
LiveAdmin is an admin UI library for Phoenix applications built on Phoenix LiveView and Ecto. It provides a customizable administrative interface for managing application data with features like resource-based views (index, show, create, edit), custom actions and tasks, multi-tenancy support via Ecto prefixes, persistent user sessions, notifications via Phoenix.PubSub, and internationalization via Gettext. The architecture follows a modular design with clear separation of concerns between routing, resource management, components, and session handling. Key entry points include the LiveAdmin.Router.live_admin/3 macro for defining admin routes and LiveAdmin.Resource.__using__/1 for defining admin resources. The system relies on external dependencies including Phoenix, Phoenix LiveView, Ecto, Gettext, and Nimble Options for configuration validation.
Kamaji is a Kubernetes operator that transforms any Kubernetes cluster into a management cluster capable of orchestrating multiple independent tenant control planes. It provisions and manages Tenant Control Plane (TCP) custom resources—essentially running full Kubernetes control planes (kube-apiserver, kube-scheduler, kube-controller-manager) as pods inside a management cluster, using unmodified upstream Kubernetes components and kubeadm for bootstrapping. The operator extends Kubernetes via three CRDs: TenantControlPlane (namespace-scoped), DataStore (cluster-scoped, backing store abstraction), and KubeconfigGenerator. It supports multiple datastore drivers (etcd, MySQL, PostgreSQL, NATS via Kine) with TLS, basic auth, and live migration. The architecture features multiple controllers (main TCP reconciler, datastore lifecycle, certificate lifecycle, KubeconfigGenerator, telemetry), mutating/validating webhooks, and a per-TCP 'soot' manager that handles kubeadm phases, addons (CoreDNS, kube-proxy, Konnectivity), and write permissions. It integrates with Cluster API as a control plane provider and exposes Prometheus metrics, a Grafana dashboard, and optional telemetry. The codebase is a standard Go-based controller-runtime operator with Helm charts for deployment.
HotGo is a full-stack rapid application development framework built on GoFrame (Go) and Vue 3 (Naive UI). It provides an admin panel with RBAC, multi-tenancy, code generation, plugin/addon system, and integrations for payments (Alipay/WeChat/QQ), SMS, email, file storage (local/S3/MinIO/COS/OSS), message queues (Redis/Kafka/RocketMQ/disk), WebSocket real-time messaging, TCP server with RPC, and cron scheduling. The backend follows a modular service layer with generated DAO/entity patterns and custom ORM handlers for data filtering, tenant isolation, and sorting. The frontend is a dynamic SPA with built-in components for tables, forms, modals, uploads, and charts, plus i18n support. The codebase is production-ready but heavily relies on code generation and custom forks of GoFrame CLI tools, introducing some maintenance risk. Designed primarily for Chinese developers building enterprise admin systems.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.
This is a large TypeScript monorepo for Sourceloop, a LoopBack 4-based microservices platform for building multi-tenant enterprise SaaS applications. It contains 14+ pre-built microservices covering authentication, audit, notification, chat, scheduler, payment, survey, search, video-conferencing, BPMN/workflow, task management, reporting, feature toggles, OIDC, and user-tenant management. Each service is packaged as a pluggable LoopBack component with controllers, models, repositories, providers, and database migrations for both PostgreSQL and MySQL. The repo also includes reusable cross-cutting packages for caching, observability, file uploads, feature flags, and a CLI for scaffolding new microservices and UI projects, plus many sandbox example applications demonstrating real-world integrations.
OptimaJet.Workflow is a .NET workflow engine library designed for business process management and automation. It provides a core runtime for defining, executing, and persisting workflow schemes (process definitions) across multiple database backends including SQL Server, MySQL, PostgreSQL, Oracle, SQLite, and MongoDB. The engine supports multi-tenancy, version control of workflow schemes, and includes a visual HTML5 designer for creating workflows. It is architected as a library/framework layer, intended to be integrated into applications rather than running as a standalone service. The codebase demonstrates a hybrid architecture, combining modern .NET Core samples with legacy .NET Framework implementations using Windows Workflow Foundation (WWF). This duality is evident in the presence of both `OptimaJet.Workflow.Core` (modern) and `Other/WorkflowFoundation` (legacy) directories. The library relies heavily on the Provider Pattern for persistence, allowing developers to swap database backends via dependency injection. It also features a robust migration framework (FluentMigrator for SQL, custom scripts for MongoDB) to manage schema evolution, particularly around multi-tenancy support (`TenantId` columns). While the library offers solid engineering patterns like generic database abstraction (`DbObject<T>`) and async/await persistence, the codebase suffers from significant technical drift. It includes deprecated technologies such as `System.Workflow` and WCF, and sample applications rely on older versions of frameworks like ABP (v6.5.0) and .NET Core 2.2. The duplication of persistence logic across five different database providers increases maintenance overhead and the risk of schema drift between implementations.