An open-source, self-hosted system status page and incident tracker designed for modern engineering teams.
- Real-Time Status Updates via SSE: Broadcasts service health changes instantly to all active visitors using Server-Sent Events — zero page refresh required.
- Incident Timeline Feeds: Log chronological timeline updates from Investigating → Monitoring → Resolved to provide transparency during outages.
- Outage Auto-Detection: Executes cron jobs to identify unacknowledged downtime and auto-generate draft incidents if components remain down for more than 5 minutes.
- Incident History & Pagination: Lists searchable, resolved historical events with calculated time-to-resolution logs for SLA metrics.
- Role-Based Admin Dashboard: Manage individual system components, reorder services with ▲/▼ triggers, and coordinate active incident threads from a central dashboard.
- Optimistic UI Status Toggles: Service status changes update instantly in the UI with automatic rollback if the API request fails.
- Email Verification Flow: Newly registered accounts receive a console-logged verification link; unverified accounts cannot log in.
- Password Reset via Secure Link: Token-based password reset flow — SHA-256 hashed tokens stored at rest, single-use, with 15-minute TTL.
- Toast Notifications: Real-time Sonner toast alerts for all admin mutations (service CRUD, incident management, auth events).
- Custom 404 & Error Pages: Styled not-found and global error boundaries matching the application design system.
- System-Aware Dark Mode: Swaps styling palettes seamlessly based on active user or OS preferences.
- Mobile Responsive Layouts: Optimized touch target paddings and responsive grids for viewports down to 375px (iPhone SE).
- Security Headers: Strict HTTP security headers applied via Vercel config (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy).
| Technology | Purpose / Layer |
|---|---|
| Next.js 16 | Application Framework (App Router & React Server Components) |
| TypeScript | Strict Type Checking & Safe Data Modeling |
| PostgreSQL | Relational Database Store |
| Drizzle ORM | Object-Relational Schema Mapping & SQL Query Client |
| Tailwind CSS v4 | CSS Utility Styling with Persisted Variables |
| Sonner | Toast Notification System |
| iron-session | Secure, signed HTTP-only session cookies |
| Argon2id | Password Hashing (via @node-rs/argon2) |
| Resend | Transactional Email Delivery (password reset) |
| Server-Sent Events | Real-time push communications for Client Sync |
| Vercel | Deployment Platform & Cron Job Scheduler |
Get StatusForge running locally in under 5 minutes:
# 1. Clone the repository
git clone https://github.com/Adarsh290406/StatusForge.git
cd StatusForge
# 2. Install dependencies
npm install
# 3. Configure environment variables
cp .env.example .env
# 4. Push the schema to your database
npx drizzle-kit push
# 5. Start the development server
npm run devPrerequisites: Node.js 18+ and a running PostgreSQL database instance.
| Variable Name | Description | Default / Example Value |
|---|---|---|
DATABASE_URL |
PostgreSQL connection URL string. | postgresql://user:password@localhost:5432/statusforge |
SESSION_SECRET |
64-character random string used for secure auth cookies. | replace-with-a-random-64-character-string |
RESEND_API_KEY |
API key from Resend for sending password reset emails. | re_xxxxxxxxxxxxxxxxxxxxxx |
AUTO_DETECTION_THRESHOLD_MINUTES |
Minutes a service must be Down before auto-generating a draft incident. | 5 |
AUTO_DETECTION_INTERVAL_SECONDS |
Cron run frequency in seconds. | 60 |
CRON_SECRET |
Secret token to authenticate incoming requests to the cron route. | replace-with-a-random-secret-for-cron-endpoint |
UPSTASH_REDIS_URL |
Redis URL for rate-limiting (production only). | redis://... |
UPSTASH_REDIS_TOKEN |
Access token for rate-limiting (production only). | token-string |
NEXT_PUBLIC_APP_URL |
Base public URL where the application is deployed. | http://localhost:3000 |
After signing up, a verification link is printed to the server console (dev-friendly):
================================================================================
[DEV ONLY] Email Verification Link for you@example.com:
http://localhost:3000/verify-email?token=abc123...
================================================================================
- Tokens are SHA-256 hashed before storage and expire after 24 hours.
- Unverified accounts receive a clear error when attempting to log in.
- On successful verification, users are redirected to
/login?verified=truewith a success banner.
- Submit email on
/forgot-password. - A secure reset link is sent via Resend (or printed to console in dev when using sandbox).
- Click the link →
/reset-password?token=...→ enter a new password.
- Tokens are SHA-256 hashed, single-use, and expire after 15 minutes.
StatusForge is architected as a Next.js App Router project leveraging React Server Components (RSC) for optimized initial loads and Client Hooks for real-time SSE stream events. The persistence layer uses PostgreSQL managed with Drizzle ORM enforcing schema isolation and user role restrictions. Standalone cron functions automatically track service states to manage recovery behaviors without background daemon processes.
For a deep dive into data models, system flows, and technical design patterns, refer to the System Architecture Guide.
Features deliberately deferred to v2 to protect product complexity and initial release timelines:
| Feature | Reason for Deferral |
|---|---|
| Multi-Tenant Orgs | Adds high complexity around slug-based routing, permission splits, and dynamic org switching. |
| SMS/Email Subscriber Notifications | Requires queue handlers and customer preference matrices, adding high operations overhead. |
| OAuth Chat Integrations | Webhook triggers for Slack/Discord require separate integration layers and platform permissions. |
| Full Audit Log Table | Author IDs inside incident logs are sufficient for basic traceability in v1. |
| Custom Domains | Dynamic DNS pointer routing and SSL validation are out of scope for early deployments. |
| Incident Templates | Manual logs are sufficient for early-stage operations. |
| Programmatic API Keys | Key rotation mechanisms and scoped permission routers deferred to v2. |
| Landing Page | Public Status Board |
|
 |
| Mobile Status Board | Admin Services Dashboard |
 |
 |
| Incidents Management | Email Verification |
 |
 |
| Custom 404 Page | Login with Verification Banner |
 |
 |
Sign up directly from the landing page to register your own organization. After signing up, check the server console for the email verification link — no email client required during local development.
Distributed under the MIT License. See LICENSE for more information.