nova-id
Production IAM on the Ory Stack — Kratos, Hydra, Keto, Oathkeeper — with Zero Trust gateway and Vue 3 frontends.
- PROBLEM
- Off-the-shelf identity providers (Auth0, Cognito) are black boxes; building on the Ory Stack instead meant owning the session validation, permission modeling, and Zero Trust enforcement rather than trusting a vendor SaaS.
- ROLE
- Sole author — designed the Zero Trust topology (isolated Docker networks, no exposed internal ports), wrote all 15 Oathkeeper access rules, and built a dual RBAC model (platform vs. app roles).
- OUTCOME
- A working Zero Trust gateway where Oathkeeper is the only public bridge to the internal Ory services (Kratos, Hydra, Keto), with 3 integrated Vue 3 frontends and full self-service identity flows — login, recovery, TOTP, OAuth2 consent — working end-to-end.
- ▸Zero Trust — every request flows through Oathkeeper; internal services are never exposed
- ▸Full Ory Stack: Kratos (identity), Hydra (OAuth2/OIDC), Keto (RBAC), Oathkeeper (gateway)
- ▸Three Vue 3 frontends: Auth UI, Admin dashboard, downstream test app
- ▸One-command setup: `docker compose up -d && ./scripts/setup-all-permissions.sh`
Production IAM on the Ory Stack with Zero Trust architecture
Nova ID is a self-hosted identity and access management platform built on the full Ory Stack — Kratos (identity, sessions), Hydra (OAuth2/OIDC), Keto (RBAC), and Oathkeeper (gateway) — with three Vue 3 frontends. Every request goes through Oathkeeper; nothing internal is directly exposed.
Why I built it
I kept needing auth for side projects and re-implementing the same JWT-based half-solution every time. Once you go past hello-world, the gap between "I have JWT auth" and "I have production IAM" is enormous — sessions, refresh tokens, OAuth2, RBAC, audit, multi-tenant invites, password reset flows, MFA. I wanted to learn the Ory Stack properly by integrating all four pieces into a working Zero Trust system, with frontends that show how to consume it correctly.
What it does
- Zero Trust architecture — every request flows through Oathkeeper for authentication, authorization, and header injection. Internal services are never exposed.
- Kratos for identity, registration, login, sessions, password reset, email verification.
- Hydra for OAuth2 and OIDC token issuance.
- Keto for RBAC with
platform_adminandplatform_usernamespaces. - Oathkeeper as the single gateway — auth, authz, header injection.
- Three Vue 3 frontends — Auth UI (login/registration), Admin dashboard (user management), and a test app showing how a downstream consumer authenticates.
- One-command setup —
docker compose up -d && ./scripts/setup-all-permissions.sh. - Architecture docs with Mermaid diagrams covering the request flow end-to-end.
Stack
Ory Kratos, Ory Hydra, Ory Keto, Ory Oathkeeper, Vue 3, Vite, Docker Compose.
Status
Active. MIT.