Emberwake is your services' home base: a single-container web app that renders your applications and bookmarks as an instant, searchable dashboard, with built-in editors, multi-user accounts, live service-status and weather widgets, optional Docker/Kubernetes auto-discovery, and a modern theme builder. The whole stack — UI included — is Rust.
Status: all nine user stories (US1–US9) are implemented across Phases 1–11. Phase 12 (Polish) finalizes CI/CD, performance validation, security verification, E2E tests, and documentation. See
CHANGELOG.mdfor the full feature list.
- End-to-end Rust — Leptos (server-side rendering + island hydration) with typed server functions as the client/server boundary. No JavaScript runtime and no Python anywhere in the codebase or the image.
- Security-first, by design — multi-user Argon2id auth, server-side revocable sessions,
CSRF protection, a strict Content-Security-Policy, rate limiting, optional OIDC SSO and
WebAuthn passkeys, read-only Docker/Kubernetes access, an append-only audit log, and a
hardened supply chain (cargo-deny/audit, SBOM, signed images). Full threat model in
security.md. - Performance as a tested feature — fine-grained reactive SSR (no virtual DOM), SQLite (WAL) with compile-time-checked SQLx, fully async. Budgets: ≤48 MB idle, <50 ms first-byte, <350 KB hydration bundle, <1.5 s cold start.
- Modern capabilities — live service-status monitoring and weather over SSE, live Docker-event discovery, a design-token theme builder, JSON/HTML/OPML import, and first-class observability (tracing + OpenTelemetry + Prometheus).
docker run -p 5005:5005 \
-v emberwake-data:/var/lib/emberwake \
-e DATA_DIR=/var/lib/emberwake \
--user 10001:10001 --read-only --tmpfs /tmp \
ghcr.io/draco-lunaris/emberwake:latestOpen http://localhost:5005, complete the first-run admin setup, and start adding services.
See specs/001-greenfield/quickstart.md for the full
development, build, and deployment workflow (including optional built-in HTTPS via ACME).
This is a spec-driven project. The design lives under specs/001-greenfield/:
| Document | What it covers |
|---|---|
.specify/memory/constitution.md |
The five governing principles (full-Rust, security, performance, testing, reproducible artifact) |
spec.md |
Prioritized user stories, functional requirements, success criteria |
plan.md |
Technical context, project structure, constitution check |
research.md |
Technology decisions and rejected alternatives |
data-model.md |
The SQLite schema |
security.md |
STRIDE threat model and controls |
contracts/ |
Typed server-function boundary + public REST/SSE/OIDC surface |
tasks.md |
The phased, story-grouped implementation backlog |
Leptos 0.8 (SSR + hydrate) on Axum/Tokio · SQLite (WAL) via SQLx · tower-sessions + Argon2id ·
optional OIDC (openidconnect) / passkeys (webauthn-rs) · rustls (no system OpenSSL) ·
bollard + kube-rs (read-only) · tracing + OpenTelemetry + Prometheus · built with cargo-leptos,
shipped as a signed multi-arch (amd64/arm64) ubuntu:26.04 image.
Contributions are welcome under Apache-2.0. Please read
CONTRIBUTING.md and the
constitution first — the security and testing principles
are hard gates. For vulnerabilities, see SECURITY.md.
Emberwake is licensed under the Apache License 2.0.
It is an independent, clean-room project. It was inspired by the self-hosted startpage
idea popularized by Flame (by Paweł Malak) and its fork
Dragons-Flame, but it shares no source code or assets with either and is not a derivative
work of them. That inspiration is acknowledged here with thanks; see NOTICE.