// OPEN-SOURCE · RUST-NATIVE · SECURITY-HARDENED · SELF-HOSTABLE

Infinity Security Stack

Four open-source, Rust-native replacements for the most over-monetised SaaS infrastructure on the market — identity, observability, data & vector, and streaming & search. Hardened by default. One fast binary each. Apache-2.0. No per-seat tax.

SECURITY REVIEW PASSEDONE BINARY PER SERVICENO GC · NO JVM · NO SSO TAX
★ Star the monorepoExplore the tools ↓
infinity-stack — quickstart
🛡️Infinity ID:8080 · edge :9000📊Infinity Observe:8090🧬Infinity Data:8094🌊Infinity Stream:8092
🔒
Secure by design
Hardened defaults, not an upsell
📦
Single binary
SQLite local · Postgres/S3 to scale
💸
No per-seat tax
Your bill scales with hardware
🦀
All Rust
Memory-safe, no GC tail latency
Services
4
Identity · Observe · Data · Stream
Language
100% Rust
axum · tokio · sqlx
Security Review
Passed
findings remediated & verified
License
Apache-2.0
commercial friendly
// HARDENED BY DEFAULT

The shared security baseline

Security is not an enterprise tier here. Every service in the stack ships with the same hardened baseline, and each tool has passed automated security review with findings remediated and verified.

🔑Argon2id passwords
Memory-hard hashing at OWASP parameters (19 MiB, 2 passes) — credential floods are expensive by construction.
🍪Opaque server-side sessions
Random tokens hashed at rest. HttpOnly + SameSite=Strict cookies, Secure by default off loopback, 2-hour default TTL with server-side revocation and expired-session purging.
🎭RBAC everywhere
Role guards on every admin and write path, with privilege-escalation protection — no unauthenticated data access.
🚦Lockout + rate limiting
Per-account login lockout plus global per-IP rate limiting on every service — with memory-bounded throttle state that can't be exhausted.
🧱Hardened HTTP headers
CSP, HSTS, X-Frame-Options: DENY, nosniff, Referrer-Policy and Permissions-Policy on every response.
💉Parameterized SQL
Every query uses sqlx bind parameters — no string-built SQL anywhere in the stack.
🗝️Hashed API keys
Ingest and data-plane keys are shown once, stored only as hashes, and resolved via O(1) indexed lookup with constant-time confirmation.
🕵️Anti-enumeration
Uniform errors with timing equalization — account status is only checked after password verification.
// ONE MONOREPO · FOUR SERVICES · FOUR PORTS

Architecture at a glance

Infinity ID:8080 + Edge :9000
OIDC / OAuth2 identity provider · TOTP MFA · RBAC
SQLite local · embedded dashboard · rust-embed SPA
Infinity Observe:8090
logs · metrics · traces · alert rules
SQLite local · embedded dashboard · rust-embed SPA
Infinity Stream:8092
durable topics · BM25 search · WebSocket fan-out
SQLite local · embedded dashboard · rust-embed SPA
Infinity Data:8094
HNSW vector search · analytics tables
SQLite local · embedded dashboard · rust-embed SPA
// THE FOUR TOOLS

Explore each service in depth

🛡️

Infinity ID

Secure-by-design identity & access management
:8080 · edge :9000FLAGSHIP
replaces → Auth0 · Okta · OneLogin · Clerk
OIDC / OAuth2
Protocols
TOTP
MFA
RS256 + JWKS
Signing
Argon2id
Hashing
▸OIDC discovery + JWKS — validate tokens anywhere
▸Auth Code + PKCE (S256 only), client credentials, refresh rotation
▸TOTP MFA with one-time codes + hashed recovery codes
▸RBAC with resource:action permissions and wildcards
▸Immutable audit log of every security event
▸Infinity Edge — auth-aware reverse proxy with per-route scopes
ROADMAP →WebAuthn / passkeysSAML 2.0 IdPPostgres + key rotationSCIM provisioning
RustaxumsqlxRS256Argon2idJWKS
View repo →
📊

Infinity Observe

Unified logs, metrics & traces
:8090ALPHA
replaces → Datadog · Splunk · New Relic · Sentry
3 (L·M·T)
Signals
t-digest
Quantiles
Bearer keys
Ingest
Rules
Alerts
▸JSON ingest for logs, metrics & traces — key required on every write
▸t-digest streaming p50/p90/p95/p99 latency summaries
▸Full-text log search by service, level, time & tokens
▸Trace listing with per-trace span waterfalls
▸Alert rules on error-log volume and metric p99 thresholds
▸Ingest keys shown once, stored only as SHA-256 hashes
ROADMAP →OTLP HTTP / gRPCParquet + object storageDataFusion / ArrowInfinity ID SSO
Rustaxumt-digestSQLiteOTel-style
View repo →
🧬

Infinity Data

Analytics + vector search in one binary
:8094ALPHA
replaces → Snowflake · Databricks · Pinecone
HNSW
ANN Index
cosine / L2
Metrics
Analytics
Tables
Scoped
Keys
▸Vector collections with fixed dimension + distance metric
▸HNSW approximate nearest-neighbour search
▸Top-k similarity search with scores + metadata
▸Tabular storage & query for simple analytics
▸Scoped API keys for programmatic ingest / query
▸RBAC-guarded admin with immutable audit trail
ROADMAP →SQL front-end + optimizerS3 columnar backendDisk-spilling HNSWInfinity ID auth
RustHNSWaxumSQLitesqlx
View repo →
🌊

Infinity Stream

Streaming, search & real-time pub/sub
:8092ALPHA
replaces → Kafka / Confluent · Elasticsearch · Algolia · Pusher
Segmented
Log
BM25
Search
WebSocket
Realtime
Consumer
Groups
▸Durable topics — append-only log, partitions, offsets
▸Consumer groups with HTTP produce / consume / commit
▸BM25-ranked full-text search indexes built in
▸WebSocket subscribe for live fan-out (Pusher-style)
▸Least-privilege data-plane API keys
▸RBAC-guarded admin with immutable audit trail
ROADMAP →Kafka wire-protocol compatCompaction + retentionDistributed replicationInfinity ID ACLs
RustBM25WebSocketaxumtokio
View repo →
// COMPETITOR REPLACEMENT MATRIX

Legacy SaaS vs the Infinity stack

Identity
Auth0 / Okta / Clerk
VS
Infinity ID
OIDC, PKCE, TOTP MFA, RBAC, edge gateway — no SSO tax
Observability
Datadog / Splunk
VS
Infinity Observe
Logs + metrics + traces + alerts in one binary
Vector + Analytics
Pinecone / Snowflake
VS
Infinity Data
HNSW k-NN + tables — no per-credit billing
Streaming + Search
Kafka / Elastic / Algolia
VS
Infinity Stream
Commit log, consumer groups, BM25, WebSocket — no JVM
Predictable cost
Replace unpredictable consumption pricing with infrastructure you can size and control.
Security controls in-core
No enterprise-tier lockout for security fundamentals such as auth, rate limits, and auditability.
Own your stack
Deploy where you need: local, private cloud, sovereign region, or hybrid environments.
// SIDE-BY-SIDE, NEVER BIG-BANG

The 5-step migration playbook

1
Map current vendor usage and critical data paths
2
Spin up Infinity equivalent service in parallel
3
Run mirrored traffic and validate parity metrics
4
Cut over by domain (auth, observability, data, stream)
5
Decommission SaaS and keep rollback snapshots for 30 days
// FREQUENTLY ASKED QUESTIONS

Straight answers

Four open-source, Rust-native services — Infinity ID (identity), Infinity Observe (observability), Infinity Data (vectors + analytics) and Infinity Stream (streaming + search) — built as self-hostable replacements for over-monetized SaaS. Apache-2.0 licensed.
Every service ships hardened by default: Argon2id password storage, opaque server-side sessions with HttpOnly and SameSite=Strict cookies and a 2-hour default TTL, RBAC, O(1) indexed API-key auth with constant-time confirmation, per-account lockout plus per-IP rate limiting, hardened HTTP security headers and fully parameterized SQL. Each tool has passed automated security review with findings remediated and verified.
Yes for small and medium workloads. Each service is one binary with an embedded dashboard on its own port (8080, 8090, 8092, 8094), so you can start on one node and split by domain as usage grows.
No. Each product is a fast single binary with SQLite storage and an embedded dashboard — cargo run and you're live. Docker and Compose are provided for cloud deployment.
The recommended pattern is side-by-side migration. Keep your current stack live, mirror workloads to Infinity services, validate parity, then cut over by domain and keep rollback snapshots.
Yes. The entire monorepo is Apache-2.0 — no per-seat billing, no per-MAU pricing, and no security features locked behind an enterprise tier.
// ONE MONOREPO · APACHE-2.0
Own your infrastructure again
Clone it, run it locally in one command, or self-host on any cloud. No vendor lock-in, no consumption bill-shock, no security features held hostage behind an enterprise tier.