Enterprise and Cloud
Design documentation for the enterprise surface. Ovara is pre-release: SSO, compliance reporting, and the hosted control plane exist in the repository and are stabilizing toward V1.0.0.
Single sign-on
enterprise/sso/ provides OIDC and SAML providers so gateway operators authenticate through the company identity provider instead of static tokens. Operator bearer-token auth remains for automation and CI.
Compliance reporting
enterprise/compliance/ generates audit-ready reports:
- SOC2 - control evidence mapped to gateway decisions and receipts
- GDPR - data-access summaries from the audit trail
- Audit summaries - signed receipt exports over any time window
Reports draw from the same hash-chained, 365-day-retained receipt store as the API - nothing is reconstructed after the fact.
Hosted control plane
cloud/control-plane/ (Fastify + Drizzle ORM + PostgreSQL) offers multi-tenant operation:
- gateway enrollment with ed25519 key generation
- policy distribution to enrolled gateways
- API key management with revocation APIs
- cloud heartbeat and enrollment sync
Infrastructure at scale
Terraform Kubernetes manifests ship multi-region deployment (us-east-1, us-west-2, eu-west-1, ap-southeast-1) with gateway autoscaling (HPA 3-20), PostgreSQL, Docker Compose full stack, Dockerfiles for all services, and 3 GitHub Actions workflows.
Admin dashboard
apps/admin-dashboard/ (Next.js): gateway monitoring, a policy editor, the audit log viewer, plus organizations, gateways, and settings pages.
Federation
trust/ implements the cross-organization trust graph with DFS path computation and portable ed25519-signed receipts - one org's gateway can verify another's receipts without shared infrastructure. Trust state exports/imports for backup and migration. See Trust Scoring and Receipts.
Migration tooling
tools/migration/ moves local data to cloud (converter, exporter, importer, validator); tools/benchmarks/ generates load with percentile reporting for capacity planning.