oore-core
Shared library with database layer, models, crypto, and webhook handling.
Architecture
Oore is a self-hosted CI/CD platform designed to run on dedicated Mac hardware. It’s built with Rust for the backend and Next.js for the web dashboard.
System Overview
┌─────────────────────────────────────────────────────────────────────┐│ Oore Platform │├─────────────────────────────────────────────────────────────────────┤│ ││ ┌──────────┐ ┌──────────────┐ ┌────────────────────────┐ ││ │ oore │────▶│ oored │────▶│ Build Executor │ ││ │ CLI │ │ (server) │ │ (macOS/Linux) │ ││ └──────────┘ └──────────────┘ └────────────────────────┘ ││ │ │ │ ││ │ ┌──────┴──────┐ │ ││ │ │ │ │ ││ │ ▼ ▼ ▼ ││ │ ┌──────────┐ ┌──────────┐ ┌──────────────────┐ ││ │ │ SQLite │ │ Webhooks │ │ Artifacts/Logs │ ││ │ │ DB │ │ (GitHub/ │ │ (/var/lib/oore) │ ││ │ └──────────┘ │ GitLab) │ └──────────────────┘ ││ │ └──────────┘ ││ │ ││ │ ┌──────────────────────────────────────────────────┐ ││ └────▶│ REST API │ ││ └──────────────────────────────────────────────────┘ ││ ▲ ││ │ ││ ┌──────────────────────┴───────────────────────────┐ ││ │ Next.js Dashboard │ ││ └──────────────────────────────────────────────────┘ ││ │└─────────────────────────────────────────────────────────────────────┘Components
oore-server (oored)
HTTP server daemon with Axum, REST API, and background worker.
oore-cli (oore)
Command-line client for repository and build management.
web (Next.js)
Web dashboard with shadcn/ui components (in development).
oore-core
The shared library containing:
- Database layer: SQLx with SQLite, automatic migrations
- Models: Repository, Build, WebhookEvent, Provider types
- Crypto: HMAC verification, AES-256-GCM encryption
- Webhook handling: Signature verification, payload parsing
- Provider configs: GitHub App, GitLab OAuth
oore-server (oored)
The HTTP server daemon:
- Framework: Axum web framework
- Routes: REST API endpoints
- State: Database pool, configuration, provider configs
- Worker: Background webhook processor
- Service management: Install/start/stop as system service
oore-cli (oore)
Command-line client:
- Framework: Clap for argument parsing
- HTTP client: Reqwest for API calls
- Commands: Repository, build, webhook management
Data Flow
Webhook Processing
GitHub/GitLab oored Build Executor │ │ │ │ POST /webhooks/github │ │ ├───────────────────────────▶│ │ │ │ 1. Verify signature │ │ │ 2. Store event │ │ │ 3. Queue for processing │ │ {"status":"ok"} │ │ │◀───────────────────────────┤ │ │ │ │ │ │ 4. Process in background │ │ │ 5. Create build record │ │ │ 6. Execute build │ │ ├──────────────────────────────▶│Design Decisions
Why Rust?
- Performance: Handles concurrent builds efficiently
- Safety: Memory safety without garbage collection
- Single binary: Easy deployment, no runtime dependencies
- Cross-platform: Builds for macOS and Linux from same codebase
Why SQLite?
- Simplicity: No separate database server to manage
- Portability: Single file, easy backup/migration
- Performance: WAL mode provides excellent read/write performance
Why ULID for IDs?
| Benefit | Description |
|---|---|
| Sortable | Lexicographically sortable by timestamp |
| Unique | 128-bit random component |
| URL-safe | No special characters |
| Readable | Easier to work with than UUIDs |
Example: 01HNJX5Q9T3WP2V6Z8K4M7YRBF
Why Async Webhook Processing?
GitHub requires webhook responses within 10 seconds. Processing might take longer, so:
- Receive webhook, verify signature
- Store event in database immediately
- Return success response
- Process in background worker
Security Model
Secrets Storage
| Secret | Storage | Protection |
|---|---|---|
| Admin token | Environment | File permissions (0600) |
| Encryption key | Environment | File permissions (0600) |
| GitHub webhook secret | Environment | File permissions (0600) |
| GitLab webhook tokens | Database | HMAC-SHA256 (not plaintext) |
| OAuth tokens | Database | AES-256-GCM encryption |
File Layout
oore.build/├── crates/│ ├── oore-core/ # Shared library│ │ ├── migrations/ # Database migrations│ │ └── src/│ ├── oore-server/ # Server daemon│ │ └── src/│ └── oore-cli/ # CLI client│ └── src/├── web/ # Next.js dashboard├── docs/ # Documentation (Starlight)└── landing/ # Marketing site (Astro)/usr/local/bin/oored # Server binary/etc/oore/oore.env # Configuration/var/lib/oore/oore.db # SQLite database/var/log/oore/oored.log # Server logs
# macOS/Library/LaunchDaemons/build.oore.oored.plist
# Linux/etc/systemd/system/oored.service