services/

Package account orchestrates account-wide actions across a user's owned workspaces: stopping every app/database when an account is disabled, and cascade-deleting all of a user's data when the account is removed.

Package alerting turns the platform's signal stream (app events today; metrics, jobs, cert/DNS, nodes later) into a small set of deduplicated, lifecycle-managed alerts, and fans them out to per-user notifications.

Package analytics turns Goma Gateway's per-request event stream into minute-bucketed rollups (models.AnalyticsRollup) and answers the Traffic, Performance and Web Analytics queries over them.

Package application manages applications, their config, and deployments.

Package apply is the imperative, one-shot sibling of GitOps.

Package audit writes append-only audit-log entries for mutating actions.

Package auth handles user authentication: password hashing, JWT issuance with revocable sessions, and password resets.

Package backup runs database backups and restores using the ecosystem pg-bkup / mysql-bkup tools as one-shot containers, to a per-workspace backup volume (local) or an S3-compatible bucket.

Package backupsettings manages a workspace's shared S3 backup target: the single bucket + credentials and the database/volume path prefixes that both database and volume backups draw from.

Package certificate manages workspace-scoped imported TLS certificates (bring-your-own; ACME is handled by Goma).

Package cluster auto-detects whether the manager's Docker engine is in swarm mode and, when it is, drives Docker Swarm as the internal implementation of Miabi's optional cluster mode.

Package crypto provides AES-GCM encryption for secrets stored at rest.

Package customrole manages admin-defined roles (permission sets) and enforces the cardinal RBAC rule: no privilege escalation.

Package database provisions database server instances (PostgreSQL, MySQL, MariaDB, Redis) as containers and manages the logical databases they host, so a single instance can back many apps instead of one container per database.

Package dbupgrade adapts the application and backup services to the small interfaces the database version-upgrade orchestration depends on, so both the API server and the worker can wire them without the database package importing application/backup (which would cycle).

Package directory turns a successful LDAP/Active-Directory bind into a Miabi user: it just-in-time provisions the account and reconciles the user's directory groups onto platform-admin and per-workspace access.

Package dnsprovider manages workspace DNS provider connections: connect, test, list, delete.

Package dockerimport adopts pre-existing Docker resources (hand-run containers, compose stacks, volumes, networks) into Miabi without tearing down what is running.

Package domain manages workspace-owned domains: registration, DNS-verified ownership, and the default TLS policy routes inherit.

Package edgegateway provisions the Goma Gateway container that fronts an edge-gateway node's public ingress.

Package environment manages promotion stages (dev → staging → prod) within a workspace.

Package eventbus is a lightweight in-process publish/subscribe bus used to fan out live events (e.g.

Package events records and serves application timeline events: lifecycle transitions, runtime container events, and configuration changes.

Package gitops is the declarative, pull-based half of Miabi's GitOps & CI/CD model.

Package gitrepo manages stored Git credentials used to clone private repositories at build time.

Package gpu inventories the physical GPUs on Miabi-managed nodes and resolves a running app's GPU request to concrete devices at deploy time.

Package housekeeping reconciles a node's real Docker state against what Miabi intends.

Package image manages the built-image catalog: provenance written by the pipeline build step, read APIs for the UI, and a retention GC that never collects a digest a live deployment or pinned release references.

Package job runs one-off commands in an application's runtime context (a Job) and the schedules that spawn them (a CronJob).

Package keyring manages per-workspace data-encryption keys (DEKs).

Package logintoken issues the short-lived personal API token behind the web console's "Copy login command" flow (OpenShift-style).

Package mailer sends Miabi's own platform notification emails — password resets, workspace invitations, and account welcomes — over a system SMTP server.

Package managedcert issues and renews TLS certificates via ACME DNS-01 using a workspace's connected DNS provider, storing the result in the workspace Certificates (Source=acme).

Package marketplace provides the declarative template catalog (loaded from the embedded official source) and installs templates by orchestrating the application, database, storage and stack services.

Package middleware manages Goma Gateway middlewares owned by workspaces and reconciles them into the proxy provider.

Package monitoring exposes container metrics and workspace health overviews.

Package netalloc hands out non-overlapping subnets, carved from a single platform pool (MIABI_NETWORK_POOL_CIDR), for every Docker network Miabi creates.

Package network manages Docker networks owned by workspaces.

Package node manages Docker host (server) records and their reachability.

Package notify turns persisted application events into outbound notifications: it fans an event out to a workspace's webhooks and channels, and renders/sends channel messages.

Package oauth implements the OAuth 2.0 / OpenID Connect authorization-code login flow against admin-configured providers.

Package pipeline implements Miabi's CI/CD: pipeline-as-code (kind: Pipeline) versioned with the app, PipelineRun lifecycle, and the internal runner that executes steps in isolated containers.

Package platformbackup is the admin-only disaster-recovery feature for Miabi's own control plane: it backs up and restores the platform database and platform/system Docker volumes.

Package platformimage is the deployment-config image catalog: the single source of truth for every container image the platform itself runs (database engines, backup tools, the gateway, internal helpers, the agent).

Package platformstack installs and updates Miabi's own stack — the network, the volumes, Postgres, Redis, the gateway and the control plane — directly against the Docker API, with every component tagged io.miabi.managed-by=miabi.

Package portbinding manages host port binding requests.

Package portforward gives on-demand external access to a managed database without publishing a host port.

Package quota enforces per-workspace plan limits and capabilities.

Package registry manages stored container-registry credentials used to pull private images at deploy time.

Package registryserver runs and authorizes the platform's built-in, multi-tenant Docker registry (CNCF distribution / registry:3).

Package release turns the per-application Release (a deployed, rollback-able version) into a promotable artifact: a workspace-wide catalog with provenance, approval gates per environment, and promotion (re-pointing an application at a release) that the gate guards.

Package route manages Goma Gateway routes bound to applications and reconciles them into the proxy provider.

Package runner manages build/pipeline runner records: their registration, scope (workspace-owned vs platform-shared), labels/concurrency, and reachability.

Package saferollout replaces a running container with a new image without a blind cutover.

Package secret is the Vault: workspace-scoped named secrets that env var values reference (`${{ secrets.NAME }}`) and that are resolved into a container's environment at deploy/job time.

Package session maintains a Redis-backed revocation list for JWT sessions, keyed by the token's jti claim.

Package settings provides cached, typed access to platform-wide key/value settings stored in the database.

Package stack groups related applications in a workspace.

Package storage manages persistent (Docker) volumes owned by workspaces.

Package twofactor wraps TOTP (RFC 6238) generation and validation for time-based two-factor authentication.

Package updatecheck asks GitHub, once a day, whether a newer Miabi release exists and caches the answer for the dashboard to read.

Package volumebackup archives a managed volume's contents (compressed) to the workspace's S3 target using the ecosystem volume-bkup tool as a one-shot container, and restores it.

Package webhook manages workspace webhooks and the signing/delivery of their JSON payloads.

Package workspace manages workspaces, memberships, and invitations.