Next Workspace (NextWks)

A self-hosted workspace platform — Google Workspace-like experience with integrated identity management, admin control plane, and a pluggable module system.

Features

• Workspace Launcher — Dynamic app grid dashboard with PWA install support (desktop + mobile)
• User Management — SQLite-backed user CRUD with Authelia YAML synchronization
• OIDC Authentication — Delegated auth via Authelia (v4.38) with session cookies
• Admin Panel — Templ + HTMX admin UI with bearer token API
• PWA Shell — Manifest, service worker, offline support, install-to-desktop guide
• Zero-CGO SQLite — Single-binary deployment with no system dependencies
• Pluggable Modules — Architecture ready for drop-in apps (Office, Files, Calendar, etc.)

Architecture

                    ┌──────────────────┐
                    │   Zoraxy Proxy   │
                    │  (TLS + routing) │
                    └────┬─────────┬───┘
                         │         │
            ┌────────────▼──┐  ┌──▼──────────────┐
            │   Authelia     │  │    NextWks Core  │
            │   :9091 (OIDC) │  │    :8080 (App)   │
            │                │  │                  │
            │  users_db.yml  │◄─┤  core/admin/     │
            │  config.yml    │  │  core/ui/        │
            └────────────────┘  │  core/auth/      │
                                └──────────────────┘

Repository Structure

NextWks/
├── src/                     # Go source code (github.com/lexton-it/NextWks)
│   ├── main.go              # Entry point (-config flag)
│   ├── cmd/setupcheck/      # Path verification tool
│   └── core/
│       ├── config/          # YAML config parser
│       ├── db/              # SQLite driver + auto-migrations
│       ├── admin/           # User CRUD + Authelia sync + Templ UI
│       ├── auth/            # OIDC client + session store
│       ├── ui/              # Launcher, app grid, PWA templates
│       ├── api/             # gRPC proto definitions (future)
│       ├── modules/         # Drop-in app sources (future)
│       └── supervisor/      # Module process manager (future)
├── app/                     # Dev distribution
│   ├── core                 # Compiled binary
│   ├── config.yaml          # Dev configuration
│   ├── data/                # SQLite database (dev)
│   └── static/              # PWA assets (manifest, SW, icons)
├── scripts/
│   └── install-authelia.sh  # Authelia deployment script
├── install.sh               # Production installer
└── testdata/                # Test fixtures

Quick Start

Prerequisites

• Go 1.22+
• Authelia v4.38 (install with bash scripts/install-authelia.sh)

Development

# Build
cd src && go build -o ../app/core .

# Run (from app/ directory)
cd ../app && ./core

# Run with custom config
./core -config /path/to/config.yaml

The server starts on http://localhost:8080 with:

• Workspace launcher: http://localhost:8080/ (OIDC-protected)
• Admin panel: http://localhost:8080/admin (bearer token)
• Health API: http://localhost:8080/api/health
• Auth status: http://localhost:8080/auth/status

Production Install

# Full install (build → test → deploy → systemd → smoke test)
./install.sh

# Check status
./install.sh --status

# Uninstall
./install.sh --uninstall

More options:

./install.sh --build-only    # Compile only
./install.sh --skip-build    # Install existing binary
./install.sh --config-only   # Generate config only
./install.sh --help          # Show all options

Run Tests

cd src && go test ./... -v

46 tests covering config parsing, SQLite operations, user CRUD, auth middleware, and YAML synchronization.

Configuration

# config.yaml
server:
  host: "0.0.0.0"
  port: 8080

admin:
  secret_token: "your-admin-token"   # Protects /admin/* routes

database:
  type: "sqlite"
  path: "./data/nextwks.db"

authelia:
  host: "http://127.0.0.1:9091"
  config_path: "/opt/authelia/configuration.yml"
  users_db_path: "/opt/authelia/users_database.yml"

oidc:
  client_id: "nextwks"
  redirect_url: "https://wks.lohmar.co.uk/auth/callback"
  domain: "wks.lohmar.co.uk"

Admin API

Protected by Authorization: Bearer <admin.secret_token> header.

List Users

curl -H "Authorization: Bearer $ADMIN_TOKEN" http://localhost:8080/admin/api/users

Create User

curl -X POST http://localhost:8080/admin/api/users \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"users":[{"username":"jdoe","display_name":"John Doe","email":"john@example.com","groups":"users"}]}'

Delete User

curl -X DELETE http://localhost:8080/admin/api/users/jdoe \
  -H "Authorization: Bearer $ADMIN_TOKEN"

Health Check

curl -H "Authorization: Bearer $ADMIN_TOKEN" http://localhost:8080/admin/api/health

Authelia Integration

NextWks acts as a management layer for Authelia. When users are created or deleted:

1. The user is stored in NextWks' SQLite database (source of truth)
2. The user is automatically synchronized to /opt/authelia/users_database.yml
3. Authelia detects the file change (watch mode) and reloads

On first boot, NextWks bootstraps existing Authelia users into its database.

OIDC: Authelia must be configured with the nextwks client. See the Authelia configuration guide.

License

MIT