Skip to content
AB
All projects

Project

Public template · MIT

skeleton_foundation

2026 · actively maintained

Self-installing multi-tenant SaaS foundation for one Linux server: schema-per-tenant PostgreSQL with forced row-level security, an operator console and encrypted backups. EuclidPRO.ai runs on it.

  • Fastify
  • React
  • PostgreSQL 16
  • PgBouncer
  • Cloudflare Tunnel
  • Playwright
View PRDGitHubDiscuss this work

Purpose

skeleton_foundation is a ready-made base for multi-tenant SaaS products. It ships no product features and no customer data: product teams add their features as modules that operators switch on per tenant or plan.

My role

Author

Highlights

  • One script installs it on Ubuntu 22.04/24.04 or Debian 12
  • Schema-per-tenant PostgreSQL 16 with forced row-level security, behind PgBouncer
  • Operator console: tenants, plans, domains, health, audit and upgrades
  • AES-256 encrypted daily backups with a restore check
  • Optional Cloudflare Tunnel and Turnstile; bring-your-own S3 or Postgres per tenant

Capabilities

  • Operator console with security-key sign-in: tenants, plans, configuration, operators, domains, server health, audit log and schema upgrades
  • Tenant workspaces, each with its own isolated database schema, users and roles, files, audit trail and a first-login setup wizard
  • Shared sign-in with company, username and password, without knowing the tenant's address
  • Individual-user (B2C) app with plans
  • Per-tenant feature switches for modules
  • Bring-your-own S3-compatible storage or external PostgreSQL per tenant, with Test and Activate steps
  • Encrypted daily backups with retention, and a drill that restores into a throwaway cluster

Governance & quality

  • Forced row-level security and a schema per tenant
  • Secrets generated on the server and readable by root only; nothing generated is written into .env
  • Services run as least-privilege system users
  • Console changes require a recent security-key check

Architecture & delivery

  • Fastify backends (platform, public and tenant servers) and a provisioning worker
  • React frontends: operator console, tenant workspace and individual-user app
  • PostgreSQL 16 cluster with three PgBouncer pools
  • systemd units, health checks and backup timers
  • Edge modes: Cloudflare API (automatic tunnel, DNS and Turnstile), Cloudflare token, or your own TLS proxy
  • Unit, integration and Playwright browser tests against a throwaway database; CI runs them through a real PgBouncer

Outcomes

  • Public template under the MIT licence
  • The foundation EuclidPRO.ai runs on

Skills demonstrated

  • Multi-tenant SaaS architecture
  • PostgreSQL row-level security
  • Linux operations and systemd
  • Security engineering
  • Backup and recovery design
  • Infrastructure automation
  • Automated testing
  • Developer documentation