Kanidm

# MISSION: Scaffold "Kanidm" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **Kanidm**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: Kanidm
- **What It Does**: Kanidm is a simple, secure identity management platform written in Rust: OAuth2/OIDC SSO, passkeys, RADIUS, a read-only LDAPS gateway, SSH key distribution and Linux login integration from one server with embedded storage.
- **Domain & Category**: Identity Management Platform
- **Production Scale**: 6-20 people
- **Development Mode**: CLASSIC
- **Architectural Rationale**: Kanidm ships every identity protocol from one Rust server with bundled SQLite and built-in replication, renders its UI with Axum, Askama and htmx, and maintains its own WebAuthn, JWT and LDAP crates to keep security-critical code under its control.
- **Live Website Reference**: https://kanidm.com
- **Source Repository**: https://github.com/kanidm/kanidm
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: Rust, Axum, Askama, HTMX, SQLite, Tokio, WebAuthn, OpenTelemetry, Python, Docker, Nix
- **Primary Language(s)**: Rust, Python, HTML, C
- **License of the reference repo**: MPL-2.0
- **Frontend**: HTMX — Server-rendered web UI with htmx interactions through axum-htmx; make run_htmx starts the dev server with the ui_htmx feature.; Askama — Compile-time HTML templates for the web UI, rendered into Axum responses through askama_web.
- **Backend & APIs**: Rust — Language of the server, CLI tools, Unix integration and RADIUS module (Rust 1.96 minimum).; Axum — HTTP framework for the kanidmd server (axum 0.8 with axum-extra cookies and axum-htmx guards).; WebAuthn — Passkeys and attested passkeys via webauthn-rs protocol crates; SSH key attestation via sshkey-attest.; LDAP — Read-only LDAPS gateway and LDAP/FreeIPA migration tools built on the ldap3 crates.; utoipa — OpenAPI schema for the REST API, used by the Python client to generate an OpenAPI client.
- **Data & persistence**: SQLite — Embedded storage through rusqlite with the bundled SQLite build; no external database server is required.
- **Infrastructure & deploy**: Docker — Separate images for kanidmd, the CLI tools and the RADIUS server, built on openSUSE with cargo-auditable and sccache.; OpenTelemetry — Tracing, logs and metrics exported over OTLP from the sketching logging crate.; FreeRADIUS — rlm_kanidm builds a FreeRADIUS module and kanidm_radiusd for network and VPN authentication on ports 1812 and 1813.; Python — pykanidm client library (pydantic, aiohttp) with a generated OpenAPI client and a Python FreeRADIUS integration.; Nix — shell.nix provides a development environment.
- **Tooling, testing & ops**: AGENTS.md — Agent instructions at the repository root; the README also links an AI/LLM usage policy for contributions.
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/kanidm/kanidm @ 40a8b2a)
1. **One server for OIDC, LDAP, RADIUS and Unix logins**: The README states the goal of being a complete identity provider so that no other component such as Keycloak is needed. The workspace bundles the server (server/*), a RADIUS module (rlm_kanidm), PAM and NSS modules for Linux (unix_integration/*), LDAP and FreeIPA migration tools and a CLI.
2. **Embedded SQLite instead of an external database**: The workspace pins rusqlite with the bundled feature, and the README lists two-node high availability through database replication, so a deployment runs as one binary with its own storage and replicates between nodes instead of depending on a SQL server.
3. **Server-rendered UI with Axum, Askama and htmx**: Cargo.toml depends on axum 0.8, askama with askama_web (axum-0.8 feature) and axum-htmx with guards, and the Makefile has a run_htmx target that builds with the kanidmd_core/ui_htmx feature, so the self-service web UI is rendered on the server with htmx partials rather than a JavaScript SPA.
4. **Build profiles baked into the binary**: libs/profiles (kanidm_build_profiles) reads a profile at build time, and the Dockerfiles set KANIDM_BUILD_PROFILE to container_generic, so defaults such as paths and features differ between container, distribution and development builds without runtime flags.
5. **Owning the security-critical dependencies**: The commented [patch.crates-io] table in Cargo.toml points at local checkouts of webauthn-rs, compact-jwt, concread, ldap3, crypto-glue and kanidm-hsm-crypto, showing that the team maintains its WebAuthn, JWT, LDAP and HSM crates alongside the server.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
   - Structure as a Turborepo monorepo with strict package boundaries:
     - `apps/web`: Application UI, routing, layouts, and server endpoints.
     - `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
     - `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
     - `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
   - Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
   - Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
   - Utilize HTMX 2.0 with semantic HTML templates. Return partial HTML fragments from backend handlers to update UI reactively without heavy client JavaScript bundles.
4. **Design System & Aesthetics**:
   - Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
   - Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
   - Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
   - Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer (SQLite): client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.