Stop rebuilding auth and admin for every new project.

What you get

• Passwordless magic-link auth via Resend. Sessions are JWT cookies; Redis stores magic-link tokens with TTL.
• Admin panel with user search, freeze/unfreeze, hard delete, impersonation (with banner + short-TTL token), and an append-only audit log.
• Self-contained: user-gateway runs its own migrations on startup via sqlx::migrate!, so there's no separate migrate service.
• Same-origin by default: Caddy fronts everything at one domain, so one cookie jar works across all UI services. No CORS wrangling.
• Inter-service auth without shared secrets: downstream services forward cookies to GET /api/auth/verify. Revocation is instant because user-gateway loads the user on every verify.
• Zero deploy config for TLS: set SITE_ADDRESS to your domain and Caddy auto-provisions Let's Encrypt certs.

Getting started

Clone, configure two env vars, and run one command:

git clone https://github.com/sssemil/saassy.git
cd saassy
cp .env.example .env
# edit .env: set POSTGRES_PASSWORD and JWT_SECRET
# (generate JWT_SECRET with: openssl rand -base64 32)
docker compose up -d --build

1. Visit the app

Open http://localhost (or whatever CADDY_HTTP_PORT you set):

• / — project-web landing page
• /login — magic-link sign in
• /dashboard — auth-gated example (redirects to /login if not signed in)
• /profile — your account page
• /admin — admin panel (admins only)

2. Sign in

Enter your email on /login. The magic link shows up in user-gateway's logs — or set a real RESEND_API_KEY in .env and you'll get an actual email.

docker compose logs -f user-gateway

3. Become an admin

Add your email to the ADMIN_EMAILS variable in .env (comma-separated for multiple admins), then restart user-gateway:

docker compose restart user-gateway

The next time you sign in (or simply freshen your session), the admin flag is applied. Visit /admin — you're in.

Architecture

Four microservices + Caddy + Postgres + Redis. Caddy is the single HTTP entry point and routes each path to the service that owns it:

                         ┌─────────┐
                         │  Caddy  │  :80 (dev) / :443 (prod, auto TLS)
                         └────┬────┘
                              │
        ┌───────────┬─────────┼────────────┬─────────────┐
        │           │         │            │             │
        ▼           ▼         ▼            ▼             ▼
┌──────────────┬─────────────┬────────────┬────────────┬────────┐
│ user-gateway │user-ingress │  admin-ui  │project-web │ static │
│    Rust      │  Next.js    │  Next.js   │  Next.js   │ assets │
│              │             │            │            │        │
│   /api/*     │ /login      │  /admin*   │  /         │        │
│              │ /magic      │            │  /dash…    │        │
│              │ /profile*   │            │            │        │
└──────┬───────┴─────────────┴────────────┴────────────┴────────┘
       │
       │ forward user's cookies to /api/auth/verify
       │ for identity checks — no shared JWT_SECRET
       │ in downstream services
       ▼
┌─────────────────┐
│ Postgres + Redis│
└─────────────────┘

Caddy routes

Services

API endpoints (user-gateway)

Starting a new project from saassy

Fork the repo or use it as a template on GitHub. Then:

• Leave alone: services/user-gateway, services/user-ingress, services/admin-ui, infra/caddy/, docker-compose.yml. These are the reusable bits.
• Replace: services/project-web/ with your own Next.js app (or swap it out for Astro / SvelteKit / whatever — it's just a container behind Caddy).
• Add: a project-specific backend service if you need one, behind its own Caddy route. Authenticate requests by forwarding cookies to http://user-gateway:3001/api/auth/verify.

Checking who the user is (the one pattern that matters)

Any downstream service — Next.js server component, another backend, anything — checks identity like this:

// services/project-web/app/dashboard/page.tsx
import { redirect } from 'next/navigation'
import { serverApiFetch } from '../lib/api-fetch'

export default async function Dashboard() {
  const res = await serverApiFetch('/api/auth/verify')
  if (res.status === 401 || res.status === 403) {
    redirect('/login?next=/dashboard')
  }
  const me = await res.json()  // { id, email, is_admin }
  return <main>Hello, {me.email}</main>
}

serverApiFetch forwards incoming cookies to user-gateway. No shared secret. No JWT decoding on your end. If you freeze or delete the user from the admin panel, their next request fails within milliseconds.

For AI agents

SKILL.md is saassy's single-file integration guide targeted at AI coding agents. It explains how to consume the stack from a downstream project: the auth-check pattern, the env vars, the anti-patterns. Pipe it straight into your agent — no file on disk needed. Run from the root of the project you want to add saassy to:

Claude Code:

curl -fsSL https://saassy.xyz/SKILL.md \
  | claude "Add saassy to this project following the instructions above."

OpenAI Codex CLI:

curl -fsSL https://saassy.xyz/SKILL.md \
  | codex "Add saassy to this project following the instructions above."

Using the prebuilt images

The four service images are built and pushed to Docker Hub on every main push by the CI pipeline. For multi-arch support, images are built for linux/amd64 and linux/arm64.

docker pull tqdminc/user-gateway:latest
docker pull tqdminc/user-ingress:latest
docker pull tqdminc/admin-ui:latest
docker pull tqdminc/project-web:latest

Tags include latest, main, and short commit SHAs. Tag a release like v0.2.0 on GitHub and you also get v0.2.0 and 0.2 tags.