OASIS Framework

Opinionated Architecture for Secure Isolated SaaS

OASIS is our foundational multi-tenant application framework. It provides the uncompromising security and scalability of isolated multi-tenancy - complete with per-tenant PostgreSQL schemas, domain-scoped RBAC, and per-tenant hostnames - while letting feature developers write code as if the application only ever had one customer.

Request to be notified
*.saasdomain.tld / app.customer.tld
▼
Caddy (Wildcard & On-Demand TLS)
▼
Nuxt 3 (SSR)
Go API (/api/*)

Data Isolation

schema: public (Shared)
schema: tenant_<uuid> (Isolated)
SET LOCAL search_path = 'tenant_xyz'

Technology Stack

Nuxt 3
SSR Frontend (Vue, TypeScript)
Go
Backend API & CLI tooling
PostgreSQL
Database (Schema per tenant)
Casbin v3
Access Control & RBAC
Caddy
Ingress & On-Demand TLS
Ent
Entity Framework (entgo.io)

Core Principles

Isolated Multi-Tenancy

PostgreSQL holds one schema per tenant plus a shared public schema. Each request’s transaction strictly runs SET LOCAL search_path for impenetrable isolation.

Domain-Scoped RBAC

Advanced role-based access control leveraging Casbin with fail-closed authorisations and Redis-backed policy synchronisation across instances.

Unified Codebase

One Nuxt 3 application and one Go API effortlessly serve three distinct surfaces: marketing, super-admin, and individual tenant environments.

Automated Infrastructure

Seamless deployment leveraging LXD, Docker, and OpenTofu to provision secure, automated, and repeatable infrastructure stacks.