NEXORA

A self-hosted workspace for projects, priorities, and team delivery.

NEXORA brings organizations, projects, and issue tracking together in one workspace. It is built as a TypeScript monorepo and can be deployed on your own infrastructure with Docker Compose, PostgreSQL, and Caddy.

The demo shows the real NEXORA web application running in the isolated local deployment with fictional data. Open the image to view the higher-quality WebM recording.

Why NEXORA?

• Self-hosted by design. Teams can keep project and account data on infrastructure they operate.
• One coherent workspace. Organizations, projects, issues, assignments, priorities, and roles share one permission model and interface.
• Security-conscious defaults. NEXORA uses database-backed sessions, HttpOnly cookies, request-origin validation, and an operator-controlled invite-only registration mode.
• Documented operations. Docker Compose, Caddy, PostgreSQL, SMTP, and the isolated Mailpit test workflow are covered by the deployment guide.

What it does

• Organizes work in organizations, projects, and sequentially numbered issues.
• Supports issue status, priority, descriptions, due dates, and organization members as assignees.
• Provides organization roles (OWNER, ADMIN, and MEMBER) with server-enforced permissions.
• Supports email verification and email invitations, including an operator- controlled public or invite-only registration policy.
• Uses database-backed sessions in HttpOnly cookies and validates request origins for state-changing API requests.
• Runs the API, web application, PostgreSQL, and reverse proxy as separate Docker Compose services.
• Supports SMTP for production and an optional Mailpit overlay for local email-flow testing.

Screenshots

Issue workspace

Issue workflow

Team and planning

Mobile layout

Roadmap

Available today:

• Issue list and detail views.
• Issue comments with author editing and administrator deletion.
• A Roadmap status board backed by project issue data.
• Organization membership and role management.

Planned:

• Labels.
• Notifications.
• NEXORA AI Agent v1.

The full plan with linked issues is in the Roadmap issue.

Architecture

Browser
  │ same-origin HTTP/HTTPS
  ▼
Caddy ── /api/* ──► NestJS API ──► PostgreSQL 17
  │                   │
  └── other paths ─► Next.js    └── SMTP server

Area	Technology
Web	Next.js 16, React 19, TypeScript
API	NestJS, Node.js ESM, TypeScript
Data	PostgreSQL 17, Prisma 7
Monorepo	pnpm workspaces, Turborepo
Deployment	Docker Compose, Caddy
Tests	Vitest, Node.js regression tests

Quick start: isolated local deployment

Requirements

• Docker Engine and Docker Compose v2.
• A checkout of this repository.
• Host ports 8080, 8443, 1026, and 8026 available.

From the repository root, generate a local environment file with a fresh random database password, then start the isolated app and Mailpit:

node scripts/local-setup.mjs
docker compose --env-file deploy/runtime.env -p nexora-local-test \
  -f compose.prod.yaml -f compose.local-test.yaml up -d --build

The script copies deploy/runtime.local.env.example to deploy/runtime.env (git-ignored) and refuses to overwrite an existing file unless you pass --force. To configure it by hand instead, copy the example and replace the password and its URL-encoded value in DATABASE_URL.

• App: http://localhost:8080
• Mailpit inbox: http://localhost:8026

The local example explicitly enables public registration and binds published services to loopback. Use disposable accounts and data. This Compose project uses its own PostgreSQL volume; it does not connect to a separate development database. To stop the services while preserving data, use docker compose ... down without -v.

Self-hosting

For a public deployment, use a DNS name, HTTPS, a reachable SMTP service, unique production credentials, and a protected deploy/runtime.env. The production Compose file keeps PostgreSQL and the API off published host ports; Caddy is the ingress point and obtains certificates for the configured domain. Production registration defaults to invite-only.

See DEPLOYMENT.md for the complete configuration reference, production setup, initial owner bootstrap, migrations, backups, SMTP, and troubleshooting. Do not expose the local-test overlay or Mailpit publicly.

For a new empty production database, run the documented interactive bootstrap:admin CLI through the API container. It creates the first verified owner and workspace atomically, refuses non-interactive input, and is unavailable after the database contains users.

Development

Requirements: Node.js 24 or later and pnpm 11.25.0. Start with:

corepack enable
pnpm install --frozen-lockfile
pnpm dev

The root development task starts workspace applications according to the Turborepo configuration. The self-hosted local Compose workflow is documented above; consult the individual app READMEs for package-specific commands.

Validation

Run checks from the repository root:

pnpm install --frozen-lockfile
pnpm --filter api lint
pnpm --filter api build
pnpm --filter api test
pnpm --filter api exec prisma validate --config prisma7.config.ts
pnpm --filter web lint
pnpm --filter web check-types
node --test apps/web/lib/*.spec.mjs
pnpm --filter web build
pnpm --filter docs lint
pnpm --filter docs check-types
pnpm --filter docs build
pnpm audit --prod

Docker Compose validation and image build commands are in .github/workflows/continuous-integration.yml and DEPLOYMENT.md.

Continuous integration

GitHub Actions runs on pushes to main and pull requests. The workflow checks the API, web app, documentation app, Prisma schema, production dependency audit, Compose configurations, and Docker images. Actions are pinned to immutable commit SHAs and workflow permissions are read-only.

The latest main workflow is expected to pass before a change is merged. The workflow and its previous runs are available on the repository's Actions page.

Contributing and security

• Read CONTRIBUTING.md before opening a change.
• Follow SECURITY.md to report a vulnerability privately.
• Never include credentials, session cookies, invitation links, or real user data in issues, logs, or screenshots.

Project status

NEXORA is under active development. v0.2.0 is the current preview release; see the CHANGELOG. An independent human penetration test has not yet been completed, so review the security policy before operating an internet-facing instance.

License

Copyright 2026 Murat Sert.

Except for third-party material identified in THIRD_PARTY_NOTICES.md, NEXORA is licensed under the Apache License, Version 2.0. See NOTICE for the project's attribution notice.