GraceSolutions
e29b166453
Make the Windows build produce a truly standalone .exe with no runtime DLL prerequisites, and stop tracking a placeholder index.html that the build pipeline rewrites on every run. webui package - Move the placeholder HTML out of a tracked file on disk and into a placeholderHTML const in webui.go. serveIndex falls back to that const when the embed does not contain index.html, so dev builds that skip the frontend still get a sensible landing page. - IsBuilt now checks for index.html instead of _next/ so the helper stays accurate when only the placeholder is embedded. Embed directory hygiene - dist/.gitignore now ignores everything except itself; the directory still exists for //go:embed but never shows dirty after a build. - Stop tracking the old placeholder at dist/index.html. scripts/build.ps1 - Staging step clears everything in dist/ except .gitignore (was also preserving the old index.html). - Windows amd64 builds now static-link the mingw-w64 C runtime via -ldflags '-linkmode external -extldflags "-static"' so the final orchestrad.exe depends only on standard Windows system DLLs and the Universal CRT (part of Windows 10+). Verified: no libgcc_s_seh-1, libstdc++-6, libwinpthread-1, msvcr*, or vcruntime140 imports. - Auto-discover gcc from C:\ProgramData\mingw64, Chocolatey's mingw, MSYS2 (ucrt64/mingw64), and TDM-GCC install locations so fresh checkouts build without manual PATH edits after 'choco install mingw'. - Windows arm64 is now skipped with a clear message when a matching aarch64-w64-mingw32-gcc cross-compiler is not available, instead of failing the whole run. Binary impact (windows/amd64, CGO on, static): 24.06 MB.
OrchestrAD
OrchestrAD is a modern, rule-based automation platform for Active Directory. It enables dynamic group membership, object lifecycle orchestration, and policy-driven directory operations through a clean UI, REST API, and powerful scheduling engine.
🚀 Overview
OrchestrAD replaces static scripts and JSON-based tooling with a centralized, database-backed system for managing directory automation.
It allows administrators to define rules that evaluate Users, Computers, and Groups, then automatically perform actions such as:
- Adding/removing group memberships
- Moving objects to Organizational Units (OUs)
- Creating groups dynamically
- Nesting groups
- Enforcing directory structure and policy consistency
All configuration is managed through the UI or API — no manual file editing required.
✨ Key Features
🔁 Rule-Based Automation
- Visual rule builder with condition groups and logical operators
- Supports multiple object types (Users, Computers, Groups)
- Rich condition support (equals, regex, LDAP, comparisons, etc.)
- Multiple actions per rule with ordered execution
🧠 Dynamic Directory Orchestration
- Add/remove group membership with diff-based execution
- Move objects to OUs with dynamic path generation
- Auto-create groups and OUs when missing
- Support for nested group relationships
⏱️ Scheduling Engine
- Easy schedules (e.g., every 5 minutes)
- Advanced 6-field cron expressions
- Per-rule execution control and concurrency handling
🔐 Secure Authentication & Access
- Local authentication (Argon2-secured)
- OIDC support (via NextAuth/Auth.js)
- API key system (separate from user auth)
- Role-based access control (RBAC)
🔑 Credential Management
- Reusable, encrypted credential objects
- Secure storage using AEAD encryption
- Credential testing and validation
📊 Observability & Auditing
- Centralized logging with rotation and retention
- Human-readable logs with structured context
- Full audit trail for all actions and changes
- Rule execution history and summaries
💾 Backup & Restore
- Automatic database backups with retention
- Manual backup and restore support
- Safe restore with validation and rollback protection
📦 Cross-Platform Runtime
-
Single Go binary
-
Runs as:
- foreground process
- system service
- Docker container
-
Supports Windows, macOS, and Linux (amd64 + arm64)
🧱 Architecture
- Backend: Go (Chi, sqlc, SQLite, robfig/cron)
- Frontend: Next.js + Material UI + Tailwind (Spike Template)
- Database: SQLite (WAL mode, migrations enabled)
- Auth: NextAuth/Auth.js (UI sessions) + backend RBAC/API keys
- Directory Integration: LDAP/LDAPS via go-ldap
🔐 Authentication Model
OrchestrAD separates authentication concerns:
-
Browser Sessions
- Managed via NextAuth/Auth.js
- Supports OIDC and local login
-
API Access
- Managed via API keys
- Keys can expire or persist indefinitely
- Shown only once at creation
-
Backend Authorization
- All security decisions enforced server-side
- RBAC controls access to resources and actions
🧾 Logging Format
Standard logs:
[TimestampUTC] - [Component] - [Level] - Message
Error logs:
[TimestampUTC] - [Component] - [Level] - [File:Line:Column] - Message
Logs are designed to be:
- Clear and human-readable
- Operationally useful
- Free of unnecessary noise
⚙️ Configuration
Configuration is managed via:
- Environment variables
- Secure secrets
- Database-backed runtime configuration
Supports:
- Export and import of configuration (JSON)
- Schema versioning
- Credential portability with key validation
📦 Build & Versioning
-
Version format:
yyyy.MM.dd.HHmm -
Multi-platform builds:
- Windows (amd64, arm64)
- macOS (amd64, arm64)
- Linux (amd64, arm64)
Output structure:
/binaries
/windows
/macos
/linux
Windows builds embed application icon from /resources/icons.
🐳 Docker
OrchestrAD supports containerized deployment:
-
Runs in foreground mode by default
-
Supports bind mounts for:
- database
- logs
- backups
-
Health endpoints available for orchestration
📌 Use Cases
- Dynamic group membership automation
- Directory cleanup and normalization
- Organizational policy enforcement
- Zero-touch user and device placement
- Identity lifecycle orchestration