Docs/Understand
Fleet control plane
Manage many isolated RustyAuth realms through one central plane without merging their users, keys, databases or recovery boundaries.Start with the RustyAuth Fleet page for the multi-cloud operating model, topology, analytics story and deployment paths.
Fleet owns organization and deployment metadata. Each realm remains the authority for its own identities, credentials, sessions, signing material and datastore.
The hierarchy
An environment registers one or more realms. Realm identity is immutable inside Fleet; deleting or moving a UI record never silently reassigns the remote authentication store.
The central project
Web today · shared desktop/mobile product surface
Passkey sessions · hierarchy RBAC · pairing · audit
Metadata · encrypted credentials · projections · backups
The Fleet datastore needs its own persistence, backups and clean-room restore plan because the central project may live in a different environment or cloud from every managed realm. It never replaces realm backups.
Pair a realm
- Create or select the organization, project and environment.
- Ask the target realm to issue a short-lived, single-use pairing token.
- Enter the realm management endpoint and token in Fleet.
- Fleet validates TLS, capabilities and immutable realm identity.
- The realm exchanges the token for a narrowly scoped management credential.
- Fleet encrypts the credential at rest, records the audit event and starts bounded discovery.
The dashboard and control plane connect to a realm management API—not SableDB. Direct cross-cloud database access would collapse tenant isolation, expose credentials and bypass realm authorization.
Scoped roles
| Role | Scope | Intent |
|---|---|---|
| Owner | Workspace or organization | Full policy and lifecycle control |
| Administrator | Organization, project or environment | Manage scoped resources and operators |
| Support | Assigned scope | Operational reads and permitted support actions |
| Auditor | Assigned scope | Read-only state and audit access |
The server resolves inherited scope and authorizes every operation. Hiding a navigation item in Dioxus is presentation, not enforcement. Sensitive actions require an appropriate passkey session and produce durable central audit records.
Health and analytics
Fleet reads redacted capabilities, health and bounded aggregate telemetry. It does not ingest passkey material, raw tokens or realm identity records merely to draw a chart. Fleet Analytics defines the cross-cloud delivery and rollup architecture; V1 semantics define explicit buckets, coverage and compatibility so a partial fleet cannot be presented as complete.
M9 semantics and the M10 local projector, standalone metrics, 24-hour SableDB outbox and authenticated gRPC export are shipped. Canonical GreptimeDB serving and the hierarchy-scoped dashboard read path remain M11–M14 work.
Failure isolation
- A Fleet outage must not stop realm sign-in or token verification.
- A realm outage marks only that registration unavailable.
- Revoking a pairing credential stops future central management without deleting realm data.
- Fleet restore and realm restore are independent, auditable operations.
- Native clients store short-lived credentials in the OS credential vault, never ordinary config files.
Read the complete Fleet architecture and analytics delivery program.