Orbita

Orbita is a vendor-internal admin dashboard for site licenses across all of Keyworks Technology's apps, built with Flutter (desktop / web) and talking to the central license control plane (a self-hosted Supabase running the license-admin Edge Function).

See every site, issue / renew / revoke licenses, spot newly detected sites, and watch the machines running your apps — from one place. It is never shipped to customers.

Features

• Dashboard — a fleet roll-up (active, expiring soon, expired, awaiting a license, revoked) plus the sites that need attention, with quick issue/renew.
• Sites — search, status filters, sort by attention or expiry, add/edit, and inline row actions (Issue / Renew / Revoke / Remove).
• Site detail — license, contact and notes (via GET /site, minus secrets) and the site's seats grouped by deployment, plus a copy-site-id button.
• Seats — a fleet-wide list of every machine + signed-in user, searchable, with Stale (no check-in for 7 days) and Hosts only filters.
• Add a site from a host — create a site from a detected host (the machine running a local Supabase).
• Settings — the control-plane server, theme, the expiring-soon window, issue defaults, and the release workspace + Forgejo token.
• Releases — manage the vendor's apps from one place: see each app's local and published version, and build/sign/publish it — plus Publish artifact… for builds from another host (e.g. a Windows zip).
• Self-update — checks Forgejo releases and updates itself in place, verifying each download's detached signature.
• Secrets stay secret — admin tokens live in the OS keychain.

How it works

Orbita talks to the central control plane — one self-hosted Supabase running the license-admin Edge Function. It owns the RSA signing key and is the single source of truth for every site's license.

Orbita ──HTTPS + x-admin-token──▶ license-admin (Edge Function) ──▶ control-plane DB

A site is a customer company (one license per site, not per user). Under it are deployments (labs / Supabase instances) and seats (a machine + signed-in user the app reports on sign-in); the machine running a site's local Supabase is its host. Each company also has its own local Supabase — the site's backend its clients connect to, not a control plane.

Quick start

flutter pub get

# run (desktop), supplying the admin token without committing it
flutter run -d linux --debug \
  --dart-define=CONTROL_PLANE_ADMIN_TOKEN=<ADMIN_TOKEN>

dart analyze lib/   # must be clean
flutter test        # must be green

Linux prerequisites: GTK 3 and libsecret-1-dev (for secure storage).

Configuration

The app ships pointed at the central control plane (https://centralauth.sladertech.cloud/functions/v1/license-admin), seeded as the Central connection on first run — so it works with no setup. Only the admin token is needed; enter it in Settings → Control plane server, where it is stored in the OS keychain. The server URL is changeable there too (CONTROL_PLANE_URL overrides the built-in default).

--dart-define=CONTROL_PLANE_ADMIN_TOKEN=… is a debug-only convenience: it is ignored in release builds so the token is never baked into a shipped binary. Control-plane URLs must be https:// (loopback http:// is allowed for local dev).

To publish releases from the Releases screen, enter a Forgejo API token in Settings → Releases (stored in the OS keychain). The same section sets the app repos root — the directory the panel resolves app paths against (blank uses the working directory).

Documentation

• DEVELOPER_GUIDE.md — architecture, the control-plane API, conventions, and the git & release process.
• docs/branding/naming.md — the Keyworks product family (Orbita, Tapestry, Nyra), taglines, visual system, and domain plan.
• docs/releases/ — release notes per version.