ACMS Architecture & Operating Manual
A high-security, multi-tenant credential vault, server inventory, and developer workflow platform built with Next.js 16, Supabase PostgreSQL, and Upstash Redis.
Project Overview & Mission
ACMS (Account & Credential Management System) solves a persistent engineering pain point: credential sprawl, forgotten server IPs, scattered deployment notes, and insecure plaintext credential sharing.
Engineers frequently manage dozens of hosting accounts (Hostinger, NameCheap, Spaceship, Cloudflare), VPS instances across cloud providers (Contabo, Hetzner, AWS), shell command sequences, and credit cards. ACMS consolidates this entire ecosystem into a single unified, encrypted, and audit-logged platform.
Zero-Trust Vault
Client-side token generation, SHA-256 cryptographic hashing, and AES-256 server-side encryption for passwords.
Infrastructure Graph
Relate web applications directly to servers (by ID or Ansible host) and domain registrar accounts.
Automated Cloud Backups
Header SQL snapshots dispatched to personal Telegram, Cloudflare R2, and Google Drive with one-click restore.
System Architecture & Stack
ACMS is architected for sub-50ms dashboard responsiveness, strict transactional safety, and mobile-first responsiveness:
Leverages Server Components for data fetching without exposing sensitive keys to client JavaScript bundles.
Authoritative database layer with database-level isolation policies enforcing tenant boundaries on every SQL query.
Server-only multi-tenant cache layer reducing aggregate dashboard query latencies from ~520ms down to ~43ms.
Clean, accessible, minimal UI with dark/light theme persistence and Radix UI accessible primitives.
Multi-Tenancy & Workspaces
Every record in ACMS (account, server, application, note, command) belongs to one of two visibility scopes:
- Personal Workspace: Only accessible by the owner user ID (organization_id = NULL). Even organization administrators cannot view personal credentials.
- Organization Workspace: Associated with a specific team or client (organization_id = UUID). Shared across authorized members with role-based policies (Owner, Admin, Member).
Defense-in-Depth Model
Security is the primary foundational pillar of ACMS. The system utilizes multiple independent layers of defense:
Every SQL query passes through PostgreSQL Row Level Security (RLS).
Service role keys and server encryption keys are strictly server-only.
Only the last 4 characters of passwords or card numbers are displayed in lists.
The Redis cache helper aggressively scrubs secrets before caching anything.
Authentication events, failed attempts, and data exports are recorded in login history and audit logs.
Supabase Row Level Security
Every table in ACMS (accounts, servers, applications, notes, credit_cards, commands) has RLS explicitly enabled:
-- Example ACMS Row Level Security Policy
ALTER TABLE accounts ENABLE ROW LEVEL SECURITY;
CREATE POLICY "Users access personal or org accounts" ON accounts
FOR ALL USING (
owner_id = auth.uid() OR
organization_id IN (
SELECT organization_id FROM organization_members
WHERE user_id = auth.uid()
)
);AES-256 Server Encryption & Tokens
Sensitive fields such as passwords, SSH keys, and CVVs are encrypted using AES-256 with an initialization vector (IV).
Generated on the client, hashed with SHA-256 before saving to the database. Only the last 4 characters are kept for identification.
Requires a 32-character high-entropy secret stored exclusively on the server, ensuring that database dumps cannot be decrypted without the host key.
Redis Zero-Leakage Caching
ACMS integrates an Upstash Redis cache-aside layer with a strict security boundary:
- Cache Scoping: Keys follow versioned tenant patterns separating personal vaults and organization workspaces.
- Secret Sanitization: The cache utility systematically rejects caching sensitive fields (passwords, SSH private keys, full token values, and credit card numbers).
- Instant Mutation Invalidation: Whenever a record is inserted, updated, or deleted, all associated user and org cache keys are immediately purged.
Accounts & Platform Credentials
/dashboard/accounts
Servers & Ansible Hosts
/dashboard/servers
You can register servers individually or batch-import an entire cluster. The system natively supports Ansible host strings and JSON formats:
Each server record tracks its unique database ID, host/IP address, SSH port, username, authentication type (Password or SSH Key), operating system, and status (Active, Maintenance, Inactive).
Applications & Domain Providers
/dashboard/applications
Instead of typing raw IP addresses manually into application forms, ACMS links applications directly to your registered Server ID via a searchable Combobox with a 1-click '+' quick-add button.
In the Linked Account (Domain Provider) selector, ACMS intelligently filters accounts to show only domain providers (Hostinger, NameCheap, Spaceship, Cloudflare, Porkbun, OVHcloud). You can toggle between Domain Providers Only and All Accounts at any time.
Commands, Notes & Billing Cards
Store parameterized Docker, Kubernetes, and Bash command snippets with custom tags for fast 1-click execution.
Full Markdown support for internal procedures, environment setup guides, architecture sketches, and pinned notes.
Securely stores corporate credit cards, expiration dates, and billing addresses with masked previews and encrypted CVVs.
Developer Requests & Feedback
/dashboard/dev-requests
- Categories: Bug Report, Feature Request, Infrastructure Change, Question, or Other.
- Media Attachments: Attach images (PNG, JPG, WebP), videos (MP4, WebM), log files, and PDFs directly to the request.
- Status Lifecycle: Pending → In Review → In Progress → Resolved → Rejected, with developer response notes.
Backup & Disaster Recovery
ACMS features an enterprise-grade disaster recovery and backup system designed to prevent data loss under any circumstance:
Download an authoritative .sql snapshot anytime from the dashboard header. Safe Restore features duplicate prevention and multi-line integrity parsing.
Configure your personal Telegram Bot Token & Chat ID in Settings → Telegram. Every time you trigger a backup from your user header, the file is automatically delivered to your private Telegram chat.
System administrators can configure S3-compatible Cloudflare R2 and Google Drive service accounts for automated daily snapshot rotation.
When launching a fresh deployment with an empty database, navigate to /admin/setup to initialize database tables or restore your entire vault from backup in 2 clicks.
Universal Export & Import
ACMS provides standardized data portability across all tables (Accounts, Servers, Applications, Commands, Notes, Credit Cards, Codes, Dev Requests):
Generated via exceljs with an Executive Summary cover sheet, KPI metric cards, formula-driven totals, frozen header panes, and styled status pills.
Branded multi-page PDF documents with page numbers, timestamps, KPI metrics summary, and auto-wrapping data tables.
Standardized JSON envelope preserving schema fidelity, version metadata, and relations for automated pipeline integrations and re-import.
Supports JSON, Excel (.xlsx/.xls), and CSV files. Features instant file parsing, live format preview, schema validation, and automatic duplicate rejection.
Environment, Migrations & Makefile
PORT=3100 NEXT_PUBLIC_SUPABASE_URL=your_supabase_url NEXT_PUBLIC_SUPABASE_ANON_KEY=your_supabase_anon_key SUPABASE_SERVICE_ROLE_KEY=your_service_role_key ENCRYPT_KEY=your_32_character_server_encryption_key UPSTASH_REDIS_REST_URL=https://your-upstash-instance.upstash.io UPSTASH_REDIS_REST_TOKEN=your_upstash_rest_token