misaki

User registration and account management portal for the thirdculture infrastructure. Members can apply for accounts and request access to self hosted applications. Admins can accept and deny requests and manage users.

No accounts are created or provisioned automatically. Everything is manual — misaki is a coordination layer, not an automation framework. Thus misaki relies on email to send a central address all the requests to notify admins.

Running locally

CGO_ENABLED=1 go build -o misaki ./cmd/
CGO_ENABLED=1 go build -o misaki-cli ./cmd/cli/

./misaki -db ./misaki.db -addr :8080

The server listens on :8080. Open http://localhost:8080 in a browser.

To promote the first user to admin:

./misaki-cli -db ./misaki.db admin <username>

Configuration

Configuration is read in priority order: CLI flags → environment variables → config file → built-in defaults.

Copy misaki.example.toml to misaki.toml and edit it:

Pass the config file path with -config misaki.toml or CONFIG_FILE=/path/to/misaki.toml.

Key settings

Flag / Env	Default	Description
-addr / ADDR	:8080	Listen address
-db / DB_PATH	/data/misaki.db	SQLite database path
-config / CONFIG_FILE	(none)	Path to TOML config file
-secure-cookies / SECURE_COOKIES=1	false	Add Secure flag to session cookies — enable when serving over HTTPS
-smtp-host / SMTP_HOST	(none)	SMTP server host:port for notification emails
-smtp-user / SMTP_USER	(none)	SMTP username
-smtp-pass / SMTP_PASS	(none)	SMTP password
-smtp-from / SMTP_FROM	(none)	From address on notification emails
-notify-email / NOTIFY_EMAIL	(none)	Address that receives admin notifications

SMTP is optional. If smtp-host or notify-email is empty, email notifications are silently skipped.

Docker

docker compose up -d

Note: Set SECURE_COOKIES=1 in the compose environment when HTTPS is enabled (i.e behind proxy).

CLI tool

misaki-cli lets you manage accounts directly from the server without using the web panel.

misaki-cli [-db PATH] <command>

# list all users
misaki-cli list

# create an approved account directly (bypasses the application form)
misaki-cli create <username> <password>

# approve / reject / reinstate an applicant
misaki-cli approve <username>
misaki-cli reject <username>
misaki-cli reinstate <username>

# reset a user's password
misaki-cli passwd <username> <newpassword>

# grant or revoke admin access
misaki-cli admin <username>
misaki-cli deadmin <username>

# show account info and service requests
misaki-cli info <username>

# delete an account permanently
misaki-cli delete <username>

# global service toggles
misaki-cli svc list
misaki-cli svc enable <service>
misaki-cli svc disable <service>

# per-user service management
misaki-cli usvc list <username>
misaki-cli usvc enable <username> <service>    # grant access
misaki-cli usvc disable <username> <service>   # revoke access
misaki-cli usvc setlink <username> <service> <url> # set service link (if applicable)

Services: werc, transfer, akkoma, ergo, gancio, mail, cerca, prosody, mumble, forgejo

Running tests

CGO_ENABLED=1 go test ./db/... ./server/...