Skip to content

Built in the Open

The Orbitr app — server, client, and shared packages — is source-available under the Elastic License 2.0 (ELv2). No hidden telemetry, no proprietary locks. Read the source, verify the claims, and contribute back. Pulsar (optional cloud services) is closed-source but fully documented.

License

Orbitr is licensed under the Elastic License 2.0 (ELv2). You are free to use, modify, and self-host it. The only restriction: you may not offer Orbitr as a hosted or managed service to third parties.

Read the full ELv2 license on GitHub →

Architecture

A modern monorepo designed for clarity and cross-platform reach.

Backend — NestJS

A NestJS server compiled with SWC for speed. REST endpoints for data, WebSocket gateway for real-time events, and a cron-based heartbeat for Pulsar integration. Drizzle ORM talks to PostgreSQL — no abstraction layer hides the SQL.

Frontend — React + Vite

A React SPA built with Vite. TanStack Query for server state, Zustand for client state, and Tailwind CSS for styling. The same codebase runs in the browser and inside the Tauri desktop shell.

Desktop — Tauri

Native desktop app for Windows today (macOS and Linux coming later) via Tauri. Lightweight Rust core wraps the web frontend with native menus, system tray, and auto-updates. Builds for x64 and ARM64.

Shared Packages

Validation schemas (Zod), permission flags (bitfield RBAC), type definitions, and static assets live in shared packages. Business logic is written once and consumed by every app.

Data — PostgreSQL + Drizzle

All persistent data lives in PostgreSQL. The schema is defined in TypeScript with Drizzle ORM — pushed directly in dev, with a baseline migration shipped for production. Full-text search uses native tsvector indexing. When self-hosting, Orbitr bundles an embedded Postgres instance so there is nothing extra to install.

Contributing

Bug fixes, features, docs, tests, all welcome.

Development Setup

git clone https://github.com/OrbitrChat/OrbitrChat-public
cd OrbitrChat-public
pnpm install
pnpm dev

This starts the backend, frontend, and all shared packages in watch mode. The dev server runs on localhost:4113 (API, HTTPS self-signed in dev) and localhost:5173 (UI). Vite proxies /api to the backend.

Before You Submit

  • ✓ Run pnpm test:server and pnpm test:web — all tests must pass.
  • ✓ Run pnpm build — the full build must succeed.
  • ✓ Add tests for new endpoints, hooks, and components.
  • ✓ Follow Conventional Commits (feat:, fix:, docs:, etc.).
Browse issues on GitHub →

Security Policy

We take security seriously. Here's how to report vulnerabilities.

Responsible Disclosure

If you discover a security vulnerability in Orbitr, please report it through GitHub Security Advisories. This ensures the report is private and reaches the maintainers directly.

Please do not open public issues for security vulnerabilities. We aim to acknowledge reports within 48 hours and publish a fix as quickly as possible. We credit reporters in the changelog unless they prefer to remain anonymous.

What We Consider In-Scope

  • • Authentication or authorization bypasses
  • • Remote code execution
  • • Server-side request forgery (SSRF)
  • • Cross-site scripting (XSS) or injection attacks
  • • Privilege escalation via permission bypass
  • • Cryptographic weaknesses in the identity system

Ready to dive in?

Star the repo, open an issue, or submit a pull request. Every contribution matters.

View on GitHub