Solo-built, open-source identity provider written in Go, from an empty repo to a tagged v1.0.0 release. Ships as a single static binary (no cgo) that embeds a Next.js admin console via go:embed, so deployment on both Linux and Windows is just "copy one file," whether as a native service or a container.

• RBAC: users through groups (with hierarchy) through roles through permissions, cached and invalidated on write

• Real OIDC provider: authorization_code with mandatory PKCE, refresh_token, client_credentials for service-to-service auth, JWKS, discovery. Works with GitLab, Harbor, Rancher, Grafana, Jenkins, Vault, NiFi, MinIO, and anything else that speaks OpenID Connect

• WebAuthn/FIDO2 and TOTP for MFA

• Pluggable database layer (Postgres, MySQL, MSSQL, SQLite) through dialect-aware SQL, no ORM

• Real clustering: DB-backed leader election for background jobs, Redis pub/sub fan-out for realtime WebSocket updates across instances

• Security-first onboarding: every account gets one server-configured default password and is forced to change it on first login. No endpoint anywhere accepts a caller-chosen password for someone else, and none ever returns one

• Permission-aware admin UI: the frontend hides whatever a signed-in user isn't allowed to do instead of rendering it and letting the API reject it after the fact