Skip to content

Built in the Open

The OrOrbit app — server, client, and shared packages — is source-available under the Elastic License 2.0 (ELv2). No hidden telemetry, no proprietary locks. Read the source, verify the claims, and contribute back. Pulsar (optional cloud services) is closed-source but fully documented.

License

OrOrbit is licensed under the Elastic License 2.0 (ELv2). You are free to use, modify, and self-host it. The only restriction: you may not offer OrOrbit as a hosted or managed service to third parties.

Read the full ELv2 license on GitHub →

Architecture

A modern monorepo designed for clarity and cross-platform reach.

Backend — NestJS

A NestJS server compiled with SWC for speed. REST endpoints for data, WebSocket gateway for real-time events, and a cron-based heartbeat for Pulsar integration. Drizzle ORM talks to PostgreSQL — no abstraction layer hides the SQL.

Frontend — React + Vite

A React SPA built with Vite. TanStack Query for server state, Zustand for client state, and Tailwind CSS for styling. The same codebase runs in the browser and inside the Tauri desktop shell.

Desktop — Tauri

Native desktop app for Windows today (macOS and Linux coming soon) via Tauri. Lightweight Rust core wraps the web frontend with native menus, system tray, and auto-updates. Builds for x64 and ARM64.

Shared Packages

Validation schemas (Zod), permission flags (bitfield RBAC), type definitions, and static assets live in shared packages. Business logic is written once and consumed by every app.

Data — PostgreSQL + Drizzle

All persistent data lives in PostgreSQL. The schema is defined in TypeScript with Drizzle ORM and pushed directly — no migration files, no magic. Full-text search uses native tsvector indexing. When self-hosting, OrOrbit bundles an embedded Postgres instance so there is nothing extra to install.

Contributing

Bug fixes, features, docs, tests — all welcome.

Development Setup

git clone https://github.com/ororbit/ororbit-public
cd ororbit-public
pnpm install
pnpm dev

This starts the backend, frontend, and all shared packages in watch mode. The dev server runs on localhost:3000 (API) and localhost:5173 (UI).

Before You Submit

  • ✓ Run pnpm test:be and pnpm test:fe — all tests must pass.
  • ✓ Run pnpm build — the full build must succeed.
  • ✓ Add tests for new endpoints, hooks, and components.
  • ✓ Follow Conventional Commits (feat:, fix:, docs:, etc.).
Browse issues on GitHub →

Security Policy

We take security seriously. Here's how to report vulnerabilities.

Responsible Disclosure

If you discover a security vulnerability in OrOrbit, please report it through GitHub Security Advisories. This ensures the report is private and reaches the maintainers directly.

Please do not open public issues for security vulnerabilities. We aim to acknowledge reports within 48 hours and publish a fix as quickly as possible. We credit reporters in the changelog unless they prefer to remain anonymous.

What We Consider In-Scope

  • • Authentication or authorization bypasses
  • • Remote code execution
  • • Server-side request forgery (SSRF)
  • • Cross-site scripting (XSS) or injection attacks
  • • Privilege escalation via permission bypass
  • • Cryptographic weaknesses in the identity system

Ready to dive in?

Star the repo, open an issue, or submit a pull request. Every contribution matters.

View on GitHub