Repo Map

Ionize is eight Git repositories under the Ionize GitHub organization. Each repo is independently versioned, has its own CI/CD pipeline, and ships either a container image (Dashboard, Auth, Site) or an npm package (Canvas, SDK) or a binary (Ionctl, Deploy).

At a glance

Platform, the center of gravity

github.com/bnannier/platform

The platform repo contains the runtime configuration of an Ionize deployment, separate from any application code:

• dev/compose.dev.yml, development stack (18 services, app code volume-mounted)
• prod/compose.prod.yml, production stack (16 services, all from pinned images)
• dev/ciam-kratos/, dev/iam-kratos/, prod/ciam-kratos/, prod/iam-kratos/, Kratos configs and identity schemas per domain per environment (16 config files)
• dev/ciam-hydra/, prod/ciam-hydra/, etc., Hydra configs
• prod/Caddyfile, production reverse-proxy and rate-limiting configuration
• dev/init-db.sql, prod/init-db.sql, database initialization
• prod/seed-prod.sh, dev/iam-seed-dev.sh, initial admin and demo identity seeding
• .github/workflows/, seven shared CI/CD workflows: deploy, cert-expiry-check, verify-image-pins, verify-email-enforcement, verify-prod-config, caddy-build, claude

Changes to the platform repo trigger production deploys via deploy.yml. See Internals, Deploy Pipeline.

Dashboard, admin dashboard

github.com/bnannier/dashboard

Next.js admin panel. Twelve feature modules (src/features/): analytics, auth, identities, m2m-clients, messages, oauth2-auth, oauth2-clients, oauth2-tokens, schemas, security, sessions, settings. Twenty-four API routes under src/app/api/. One instance per domain, in practice, operators primarily use the IAM Dashboard because Dashboard can manage both CIAM and IAM Kratos/Hydra through configured admin endpoints.

See Internals, Dashboard Route Map.

Auth, login UI

github.com/bnannier/auth

Renders Kratos self-service flows and Hydra consent screens. The user-visible login experience. Ten page routes. Implements the breached-password check, account-lockout, PKCE analytics, captcha integration, and social login.

See Internals, Auth Route Map.

Site, brochure + playground + docs

github.com/bnannier/site

Three things in one Next.js app:

1. Marketing landing page (/)
2. OAuth2 playground (/playground) that exercises a real Authorization Code + PKCE flow against the local CIAM or IAM Hydra
3. This documentation site (/docs) built with Fumadocs

The playground is useful for verifying a deployment end-to-end: log in via CIAM or IAM, see the decoded ID token, inspect scopes, watch the callback round-trip.

Canvas, design system

github.com/bnannier/canvas

105 React components organized by atomic-design tier: atoms (22), molecules (35), organisms (28), and charts (20, Nivo wrappers). Built on Radix UI primitives, Lucide icons, and Tailwind v4. Distributed as a source-only npm package, main: ./src/index.ts, so consumers tree-shake what they actually use and get full type inference.

Canvas has its own dedicated docs site with live playgrounds at canvas.nannier.com. The current Ionize docs do not duplicate it.

See ADR 0012, Source-Only NPM Packages and ADR 0026, Atomic Design in Canvas.

SDK, shared library

github.com/bnannier/sdk

Forty-one exports across eight TypeScript files. Imported by Dashboard, Auth, and Site. Provides:

• Settings CRUD against the ionize database (per-domain)
• AES-256-GCM encryption with HKDF-SHA256 key derivation
• In-memory TTL cache (60s default)
• Brute-force tracking, lockout, and security audit
• Session location tracking

See Reference, SDK Settings API and Internals, SDK Modules.

Ionctl, local-dev CLI

github.com/bnannier/ionctl

Interactive CLI for local development only. ionctl deploy auto-installs Podman if needed, builds dev images, starts the full Compose stack in the right order, runs migrations, seeds an admin identity, and prints access URLs. ionctl destroy tears it down. Bundles the platform configs inside its npm package so npx ionctl works in an empty directory.

Production deployment is a different beast, that's Deploy.

See Internals, Ionctl Stack Bundle.

Deploy, deployment wizard

github.com/bnannier/deploy

Tauri desktop application (macOS for now) for production deployments. Thirteen wizard pages from Repository through Destroy cover the full lifecycle. Shells out to gh, doctl, ssh, podman-compose, and provider APIs (DigitalOcean, Hostinger, Neon, Resend, Postmark, Brevo, SMTP2GO). All output flows through xterm.js with a secrets sanitizer that redacts bearer tokens, API keys, and DSN passwords.

Deploy embeds a localhost MCP server on 127.0.0.1:14210 that exposes eight tools (screenshot, get_page, navigate, click, form_input, read_context, terminal_exec, terminal_read). This means Claude can drive Deploy the same way a human can.

See Internals, Deploy MCP Server and ADR 0022, MCP Localhost Only.

Where next

• Architecture, how the repos compose at runtime.
• Get Started, run it.
• Develop, Workspace Setup, clone the eight repos as siblings.