Manager

The Manager is the control plane of the Productify Framework: a Go service with a GraphQL API and a Vue web UI where you define projects, tenants and applications, configure them, hand out credentials, and drive deployments. Every other component (the proxy, the CLI, the backend and frontend integration libraries) talks to the Manager.

Use this section when you run or develop the Manager itself. If you are integrating an application with it, start at Backend Registration, the GraphQL API or the REST API.

What it manages

Projects, tenants and applications

A project groups everything one team owns. Inside it, applications are defined once and enabled per tenant; a tenant is a customer organization whose data is separated at the database level. One deployment serves every tenant. See Multi-tenancy.

Deployments

Each application has a deployment per environment (dev, qas, run). The deployment spec (image, ports, health checks, resources, scaling, domains) is what the Manager renders into Nomad jobs and proxy vhosts. See Application Stacks and Service Routing.

Users, roles and credentials

• Project roles are a fixed set: readonly, tester, developer, maintainer, owner. Application roles are readonly or normal. Tenant roles are defined per project over a fixed permission vocabulary. Every user also carries a system role (normal, audit, administrator) that gates the administrator-only surfaces such as audit export. See Users and the Access Model.
• Self-service: tenant admins invite members and assign roles in their own scoped shell; every change is audit-logged. See Tenants.
• Machine users authenticate backends: a generated Bearer token or a username/password pair (Basic). Machine users are scoped to an environment. See Machine Users.
• Personal access tokens (PATs) give people and CI access to the API. They are stored as PBKDF2-SHA256 hashes (600 000 iterations). Mint them in the UI, or let pfy login --server <url> mint one through a browser login. See Personal Tokens and the CLI login docs.

Configuration in layers

Frontend settings (modules, themes, locales, key-value pairs) and backend settings (module configuration) are stored at three layers, project, tenant and tenant × application, and merged so the same application can look different to every tenant. The UI offers a form editor and a JSON editor. See Configuration Layers and Settings.

Triggers

Cron-scheduled callbacks to registered backends, with per-second precision. A trigger fires once per registered backend; the backend lists the application's enabled tenants (GET /api/machine/application/:id/tenants) and fans out itself. See Trigger System and Backend Registration.

Pilets

Storage, signing and per-application delivery of microfrontend modules, with staged rollouts. See Pilet API.

ESB

An API gateway in front of application endpoints, with transformation, credential injection and per-endpoint audit logging. See ESB.

Dashboards and audit log

Every project, tenant and application page opens on a read-only dashboard; the audit log records credential, membership, deployment and configuration events with a tamper-evident hash chain and a SIEM export. See Dashboard and Audit Logs.

Technology

Backend: Go 1.26, PostgreSQL via Ent, GraphQL via gqlgen, HTTP via Gin. Authentication comes from Pocket ID (OIDC) through the proxy; PATs and machine-user credentials are PBKDF2-hashed.

Frontend: Vue 3 (Composition API), Quasar, Pinia, urql, @byjohann/vue-i18n, built with Vite.

┌─────────────────────────────────────────────────┐
│                   Frontend (Vue)                │
│  ┌──────────┐  ┌─────────┐  ┌────────────────┐  │
│  │ Quasar   │  │ urql    │  │ Pinia Stores   │  │
│  │ Component│  │ GraphQL │  │ (State)        │  │
│  └──────────┘  └─────────┘  └────────────────┘  │
└─────────────────────────────────────────────────┘
                      │
                      │ GraphQL / REST
                      ▼
┌─────────────────────────────────────────────────┐
│              Manager Backend (Go)               │
│  ┌──────────┐  ┌─────────┐  ┌────────────────┐  │
│  │ GraphQL  │  │ REST    │  │ Trigger        │  │
│  │ Resolver │  │ Handler │  │ Executor       │  │
│  └──────────┘  └─────────┘  └────────────────┘  │
│  ┌──────────────────────────────────────────┐   │
│  │     Ent ORM (Schema & Queries)           │   │
│  └──────────────────────────────────────────┘   │
└─────────────────────────────────────────────────┘
                      │
                      ▼
              ┌──────────────┐
              │  PostgreSQL  │
              └──────────────┘

The same binary runs the API, the trigger executor, or both (run_mode). Health probes live on a separate port. See Configuration.

Where to go next

1. Quick Start: run the Manager locally
2. Configuration: every setting, with defaults and production requirements
3. Multi-tenancy and Trigger System: the two concepts everything else builds on
4. Deployment: production deployment

Source: ProductifyFW/manager · Issues: GitHub Issues