SecPlexus

An AI-native security operations platform.

English | 简体中文

Development

Install Go 1.27.3, Node.js 22.12+ (24 recommended), and pnpm 10.32.1.

cp .env.example .env
chmod 600 .env
# Fill the database/administrator passwords, CSRF key and internal token in .env.
# Use existing PostgreSQL/Redis, or explicitly deploy them:
pnpm compose:up postgres redis
pnpm config:check
make dev

make dev runs IAM, Console, and Web with hot reload. It connects to the configured services and never starts Docker. Missing .env is created from the example; startup stops so you can review it. Existing configuration is never overwritten.

make build       # Build both Go services and Web
pnpm preview     # Run services and preview built Web; configure the matching public origin
pnpm compose:up  # Explicitly build and deploy the complete stack
make stop        # Stop this checkout's applications and containers; retain data

IAM provides real login, voluntary password changes, revocable sessions, organizations, custom roles, and audit records. The unique system administrator defaults to admin/secplexus and is configuration-managed. Set SPX_IAM_BOOTSTRAP_USERNAME / SPX_IAM_BOOTSTRAP_PASSWORD and restart all IAM replicas to update it; application pages cannot change its identity or password. The management center and personal settings pages use real APIs. Console currently verifies organization access and SSE authorization through IAM; business workflows are not implemented. Web uses the Next.js/shadcn baseline with one CRM V1-based intelligent security workbench at /dashboard and real IAM pages at /login, /settings/profile, /settings/account and /management. Other template pages and menus are removed; the workbench currently displays sample data. The Web interface supports English and Simplified Chinese through next-intl.

See configuration and startup, testing, IAM architecture, and Web.

Go modules declare environment variables and defaults in config.yaml, use mature POSIX parameter expansion and Viper/mapstructure for strict typed decoding, and expose Cobra commands. Local rotating JSON logs use logs/iam.log and logs/console.log; containers use stdout.

Repository layout

src/apps/       Application code (web, iam, console)
src/packages/   Shared libraries, added as needed
deploy/         Deployment configuration
scripts/        Development and release scripts
docs/           Project documentation

Contributing

See the contribution guide for development setup, architecture boundaries, testing, and the pull request workflow.

Contributors

Thanks to everyone who contributes to SecPlexus.

Acknowledgements

Thanks to the maintainers and contributors of the projects used in SecPlexus and its development tools.