GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing infinitytechstack.uk — Infinity Security [2026]: Open-Source Rust Perimeter 🔒 Secure by design Hardened defaults, not an upsell 📦 Single binary SQLite local · Postgres/S3 to scale 💸 No per-seat tax Your bill scales with hardware 🦀 All Rust Memory-safe, no GC tail latency Services 4 Identity · Observe · Data · Stream Language 100% Rust axum · tokio · sqlx Security Review Passed 4 rounds · CI-enforced License Apache-2.0 commercial friendly 01 // HARDENED BY DEFAULT The shared security baselineSecurity is not an enterprise tier here. Every service in the stack ships with the same hardened baseline, each has passed four rounds of automated security review with findings remediated and verified, and every push is now CI-gated (check, test, clippy, audit). 🔑Argon2id passwords Memory-hard hashing at OWASP parameters (19 MiB, 2 passes) — credential floods are expensive by construction. 🍪Opaque server-side sessions Random tokens hashed at rest. HttpOnly + SameSite=Strict cookies, Secure by default off loopback, 2-hour default TTL with server-side revocation and expired-session purging. 🎭RBAC everywhere Role guards on every admin and write path, with privilege-escalation protection — no unauthenticated data access. 🚦Lockout + rate limiting Per-account login lockout plus global per-IP rate limiting on every service — with memory-bounded throttle state that can't be exhausted. 🧱Hardened HTTP headers CSP, HSTS, X-Frame-Options: DENY, nosniff, Referrer-Policy and Permissions-Policy on every response. 💉Parameterized SQL Every query uses sqlx bind parameters — no string-built SQL anywhere in the stack. 🗝️Hashed API keys Ingest and data-plane keys are shown once, stored only as hashes, and resolved via O(1) indexed lookup with constant-time confirmation. 🕵️Anti-enumeration Uniform errors with timing equalization — account status is only checked after password verification. 🤖CI-gated on every push GitHub Actions runs cargo check, the full test suite, clippy with warnings denied, and a dependency audit on every push and PR — regressions can't merge quietly. 02 // ONE MONOREPO · FOUR SERVICES · FOUR PORTS Architecture at a glanceInfinity ID:8080 + Edge :9000 OIDC / OAuth2 identity provider · TOTP MFA · RBAC SQLite local · embedded dashboard · rust-embed SPA Infinity Observe:8090 logs · metrics · traces · alert rules SQLite local · embedded dashboard · rust-embed SPA Infinity Stream:8092 durable topics · BM25 search · WebSocket fan-out SQLite local · embedded dashboard · rust-embed SPA Infinity Data:8094 HNSW vector search · analytics tables SQLite local · embedded dashboard · rust-embed SPA 03 // THE FOUR TOOLS Explore each service in depth🛡️ Infinity IDSecure-by-design identity & access management :8080 · edge :9000FLAGSHIP replaces → Auth0 · Okta · OneLogin · Clerk OIDC / OAuth2 Protocols TOTP MFA RS256 + JWKS Signing Argon2id Hashing ▸OIDC discovery + JWKS — validate tokens anywhere ▸Auth Code + PKCE (S256 only), client credentials, refresh rotation ▸TOTP MFA with one-time codes + hashed recovery codes ▸RBAC with resource:action permissions and wildcards ▸Immutable audit log of every security event ▸Infinity Edge — auth-aware reverse proxy with per-route scopes ROADMAP →WebAuthn / passkeysSAML 2.0 IdPPostgres + key rotationSCIM provisioning RustaxumsqlxRS256Argon2idJWKS View repo →📊 Infinity ObserveUnified logs, metrics & traces :8090ALPHA replaces → Datadog · Splunk · New Relic · Sentry 3 (L·M·T) Signals t-digest Quantiles Bearer keys Ingest Rules Alerts ▸JSON ingest for logs, metrics & traces — key required on every write ▸t-digest streaming p50/p90/p95/p99 latency summaries ▸Full-text log search by service, level, time & tokens ▸Trace listing with per-trace span waterfalls ▸Alert rules on error-log volume and metric p99 thresholds ▸Ingest keys shown once, stored only as SHA-256 hashes ROADMAP →OTLP HTTP / gRPCParquet + object storageDataFusion / ArrowInfinity ID SSO Rustaxumt-digestSQLiteOTel-style View repo →🧬 Infinity DataAnalytics + vector search in one binary :8094ALPHA replaces → Snowflake · Databricks · Pinecone HNSW ANN Index cosine / L2 Metrics Analytics Tables Scoped Keys ▸Vector collections with fixed dimension + distance metric ▸HNSW approximate nearest-neighbour search ▸Top-k similarity search with scores + metadata ▸Tabular storage & query for simple analytics ▸Scoped API keys for programmatic ingest / query ▸RBAC-guarded admin with immutable audit trail ROADMAP →SQL front-end + optimizerS3 columnar backendDisk-spilling HNSWInfinity ID auth RustHNSWaxumSQLitesqlx View repo →🌊 Infinity StreamStreaming, search & real-time pub/sub :8092ALPHA replaces → Kafka / Confluent · Elasticsearch · Algolia · Pusher Segmented Log BM25 Search WebSocket Realtime Consumer Groups ▸Durable topics — append-only log, partitions, offsets ▸Consumer groups with HTTP produce / consume / commit ▸BM25-ranked full-text search indexes built in ▸WebSocket subscribe for live fan-out (Pusher-style) ▸Least-privilege data-plane API keys ▸RBAC-guarded admin with immutable audit trail ROADMAP →Kafka wire-protocol compatCompaction + retentionDistributed replicationInfinity ID ACLs RustBM25WebSocketaxumtokio View repo →04 // COMPETITOR REPLACEMENT MATRIX Legacy SaaS vs the Infinity stackIdentity Auth0 / Okta / Clerk VS Infinity ID OIDC, PKCE, TOTP MFA, RBAC, edge gateway — no SSO tax Observability Datadog / Splunk VS Infinity Observe Logs + metrics + traces + alerts in one binary Vector + Analytics Pinecone / Snowflake VS Infinity Data HNSW k-NN + tables — no per-credit billing Streaming + Search Kafka / Elastic / Algolia VS Infinity Stream Commit log, consumer groups, BM25, WebSocket — no JVM Predictable cost Replace unpredictable consumption pricing with infrastructure you can size and control. Security controls in-core No enterprise-tier lockout for security fundamentals such as auth, rate limits, and auditability. Own your stack Deploy where you need: local, private cloud, sovereign region, or hybrid environments. 05 // SIDE-BY-SIDE, NEVER BIG-BANG The 5-step migration playbook1 Map current vendor usage and critical data paths 2 Spin up Infinity equivalent service in parallel 3 Run mirrored traffic and validate parity metrics 4 Cut over by domain (auth, observability, data, stream) 5 Decommission SaaS and keep rollback snapshots for 30 days 06 // FREQUENTLY ASKED QUESTIONS Straight answersFour open-source, Rust-native services — Infinity ID (identity), Infinity Observe (observability), Infinity Data (vectors + analytics) and Infinity Stream (streaming + search) — built as self-hostable replacements for over-monetized SaaS. Apache-2.0 licensed. Every service ships hardened by default: Argon2id password storage, opaque server-side sessions with HttpOnly and SameSite=Strict cookies and a 2-hour default TTL, RBAC, O(1) indexed API-key auth with constant-time confirmation, per-account lockout plus per-IP rate limiting, hardened HTTP security headers and fully parameterized SQL. Each tool has passed four rounds of automated security review with findings remediated and verified, now CI-enforced on every push (check, test, clippy, dependency audit), and Infinity ID supports zero-downtime signing-key rotation. Yes for small and medium workloads. Each service is one binary with an embedded dashboard on its own port (8080, 8090, 8092, 8094), so you can start on one node and split by domain as usage grows. No. Each product is a fast single binary with SQLite storage and an embedded dashboard — cargo run and you're live. Docker and Compose are provided for cloud deployment. The recommended pattern is side-by-side migration. Keep your current stack live, mirror workloads to Infinity services, validate parity, then cut over by domain and keep rollback snapshots. Yes. The entire monorepo is Apache-2.0 — no per-seat billing, no per-MAU pricing, and no security features locked behind an enterprise tier. // ONE MONOREPO · APACHE-2.0 Own your infrastructure again Clone it, run it locally in one command, or self-host on any cloud. No vendor lock-in, no consumption bill-shock, no security features held hostage behind an enterprise tier. |
| You are visitor 01402520 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |