cafaye

One CLI, independent services, each written in the language that fits its job.

cafaye exists so you never start a SaaS from scratch again: authentication, tenancy, billing, notifications, media, and AI routing — production-grade, self-hostable, and connected by typed contracts. It is an organization, not a single repository: every service below lives in its own repo, versioned and installable on its own. You can take the one you need rather than adopting the whole platform, run the whole stack on your own infrastructure, and keep it alive with the runbooks on this site. The code is free — the framework under MIT, the services under a Business Source Licence, box, pantry and the artifact distribution proprietary; what is sold is managed hosting, upgrades, and support, and the licensing page states the split and measures it against every repository.

Hosted pilot

Already decided? The shortest path from nothing to a running deployment, with the gaps stated before you commit rather than after. Hosted pilot onboarding

Start here

Install the CLI, run a service against local Postgres, and see what exists today — with every unbuilt command marked as such. Getting started

Pricing, licence and security

What a unit costs, what the licence split permits you to do, and how your credentials are handled — with no invented prices and no softened gaps. Pricing · Licensing · Security and trust

Architecture

What each service owns, how they talk, and why the boundaries are where they are. Architecture

Upgrading

Running a deployment and moving to the current contracts? What breaks, and the order to fix it in. Upgrading

Runbooks

Provision a tenant, restore a database, rotate a secret, handle an outage, chase a webhook — and run any repository’s real gate. Runbooks

Troubleshooting

Keyed by the symptom you can see, not the component you suspect. Troubleshooting

The services

Service	What it does	Language
`identity`	Users, sessions, accounts & tenancy, OIDC provider	Go
`billing`	Plans, subscriptions, prepaid credits, usage metering, processor webhooks in and out	Ruby
`courier`	Transactional email, push, and every outbound webhook — signed and retried	Elixir
`darkroom`	Signed media uploads, variants, S3 and Cloudflare R2	Rust
`muse`	LLM routing, credentials vault, token metering	Python
`gateway`	Public gateway / BFF — routing, JWT verification, rate limits	Go
`parlor`	The app shell: production-ready frontend template + admin	Next.js

The tooling

Repo	What it does	Language
`cafe`	The CLI: `cafe init · new · dev · deploy · gen · contract`	Go
`core`	The substrate: service manifests, OpenAPI & event specs, telemetry specs, generator engine	—
`pantry`	The registry: what a service is and how to reach it — closed source, public endpoint	Go
`cafaye-rb`	The shared Ruby gem: JWKS token verification, the transactional outbox, a Rails railtie	Ruby
`kit`	Shared CI workflows, lint configs, Docker bases, OTel templates for six languages	—
`docs`	This site	—

Why one language per service?

Because services have different jobs. identity holds the keys to everything — it wants Go’s discipline and static binary. courier fans out to thousands of providers concurrently — that’s the BEAM. darkroom pushes pixels — no GC pauses wanted. billing is pure domain modeling — Ruby’s home turf. muse talks to models — Python’s ecosystem is unmatched. And parlor is the web. Polyglot by design, connected by typed contracts, never by shared code.

cafaye is early, and this site is written to say so rather than around it. As of 2026-10-10 no cafe subcommand is a stub: the stub table that held init, new and gen is empty (cafe/internal/cli/stub_test.go:25), and the command table beside it is the single source of truth for which verbs work. There is no broker — no service starts an outbox publisher loop, so an event is a row and nothing more. There is also no cafaye-operated platform to deploy to: Cafaye Ops is a monthly operated tier we run on your box, not a destination cafe deploy can target. Three of the seven services are built past their first milestone (darkroom ships signed uploads and Cloudflare R2; courier ships outbound webhooks over the Standard Webhooks spec; gateway ships Redis-backed rate limits), and two have a gap a reader will hit: identity cannot reset a password or renew an access token, and gateway has no API keys and no mounted scope check since it was rewritten in Go — the TypeScript implementation that had both was deleted at cutover. Every service page states plainly what is built and what is not, and Getting started runs the whole path end to end with the commands that actually exist today.

The licence split is decided, and the grant has landed in every repository. The framework — core, cafe, kit — is MIT. pantry is closed by OPS-D10 (2026-10-10): the public catalog is part of the operated product, so its source is proprietary while its service stays publicly reachable — closed code, public endpoint, contract still open. The seven services are under a Business Source Licence: free to run, free to self-host, never to offer a competing service. box and the artifact distribution are proprietary. Licensing states the split, re-derives the table from every repository, and dates each row rather than picking a side.

A green badge is only worth what it ran. kit’s reusable workflow is callable now and ten repositories call it, but most of the fleet keeps its interesting tests in a second tier that does not run by default. identity is the one repository whose CI now refuses to skip that tier. See Running the gates.