lymphhub
In progressSelf-hosted IAM data plane connecting every TOJI service
A self-hosted IAM built on Postgres + Redis + SpiceDB. identity-svc (HTTP) handles SaaS customer signup/login/session verify, while stateless session-svc (gRPC) is called on every API request — together they act as the single authentication gateway for all TOJI services.
Flow overview
lymphhub's own steps flow left to right — click a node for detail, drag to pan, scroll to zoom. The tinted nodes are other services.
Core Features
- Multi-mode single binary — identity/session/migrate subcommands drive three K8s Deployments
- Zanzibar-style permission model via SpiceDB — the single source of truth for container membership and role assignment
- Redis hot session store — session verification never touches Postgres, p99 < 5ms
- A generic actors + containers data model unifying people, bots, and organizations under one schema
Why lymphhub
Where teams actually reach for it
HR team
› Can ERP/HR integration manage employee accounts from a single gateway, automatically?
LYMPHHUB RESPONSE
The HR system calls the lymphhub REST API directly for hire/termination events. On hire, an actor is created and department container permissions are granted automatically; on termination, a single API call revokes access across every system instantly.
HR system → identity-svc API → actor provisioning → SpiceDB grants permissions automatically
HR event → automatic actor provisioning · instant deactivation
Platform engineer
› Can K8s, IaaS, LLDAP, and services all be unified under one SSO?
LYMPHHUB RESPONSE
SpiceDB becomes the single source of truth for every actor/container permission. K8s service accounts through LLDAP users are all governed by the same Zanzibar permission model — adding a new system just extends SpiceDB relations, no schema changes needed.
actor (K8s/IaaS/LLDAP/service) → identity-svc → SpiceDB → permission check
A single authentication gateway shared across every TOJI service
Automation bot ops team
› Can we safely control permissions when an AI bot acts on a user's behalf?
LYMPHHUB RESPONSE
Bot service accounts are first-class citizens. SpiceDB's CheckPermission declaratively scopes what an agent can do, so least-privilege access applies without handing out admin credentials.
bot service account → SpiceDB CheckPermission → identity-svc performs the action
Bot service accounts — permissions declared and enforced through SpiceDB
Startup infra team
› Can we run cost-controlled, self-hosted SSO that still scales?
LYMPHHUB RESPONSE
lymphhub ships as a single Go binary, so it can start on a single server. As traffic grows, session-svc scales out automatically — there's no external auth vendor bill, just your own infrastructure cost.
Single Go binary deploy → session-svc HPA → traffic grows → auto-scale
Self-hosted — a scalable design with no external dependency