Infisical is an open-source end-to-end encrypted secrets management platform used to centralize, secure, and sync secrets across teams and infrastructure. The codebase is structured as a multi-service application with a primary Node.js/TypeScript backend (REST API using Fastify) and a newer Go backend implementing core platform services (authentication, permission evaluation, KMS, audit logging, secret manager). The frontend is a React SPA built with Vite and TanStack Router. The system supports self-hosted (Docker, Helm) and cloud-deployed modes. It provides a rich set of capabilities including dynamic secrets, secret rotation, approval workflows, machine identity federation (AWS, Azure, GCP, Kubernetes, OIDC), PKI management (internal and external CAs), privileged access management (PAM), secret scanning, audit logging, and extensive integration syncs. The architecture follows a modular service-oriented pattern with clear separation of concerns, extensive use of dependency injection and factory patterns for extensibility.
Nanocl is a distributed container orchestration system designed as a Kubernetes alternative, focusing on simplicity and declarative state management. The system manages workloads termed 'Cargoes' (containers), 'VMs', and 'Jobs' using Docker as the underlying runtime. It features a client-server architecture with a CLI (`nanocl`), a central daemon (`nanocld`), and auxiliary sidecar services for proxying (`ncproxy`) and DNS (`ncdns`). The architecture relies on Rust for performance and safety, utilizing `ntex` for async HTTP handling and `diesel` for database persistence. The core operational model is driven by declarative Statefiles (YAML/TOML/JSON) processed with Liquid templating. These files define the desired infrastructure state, which the daemon reconciles against the actual runtime state. The system integrates directly with the Docker daemon via the `bollard` library to manage container lifecycles, networking, and images. It features a robust event-driven architecture where state changes trigger sidecar updates, such as Nginx configuration regeneration for routing. The codebase demonstrates a modular design with shared crates for error handling, stubs, and utilities. It implements a generic repository pattern for database access and abstract lifecycle traits for resource management. The API is versioned and documented via OpenAPI/Swagger, supporting RESTful CRUD operations and real-time event streaming. While the project shows strong architectural patterns, it carries medium technical drift due to API versioning fragmentation and heavy dependency on Docker API behavior.