Single binary · Rust · self-hosted
Your machine,
rendered.
Point one binary at a directory. Get a live, themed web console: every file rendered on the fly, every action behind a capability grant, every mutation in a hash-chained ledger. Server-rendered HTML — no SPA, no CDN, no third-party crypto.
Not another dashboard
Every web console you have used is hand-built: each feature manually constructed, each one aging the day it ships. Renar takes the other road.
Today that means the filesystem: markdown with
footnotes and syntax-highlighted fences, JSON as structured
panels an operator can title and order, CSV as a grid, 75
language grammars with line numbers. The raw bytes are always one
?raw=1 away. Processes, services and command output
are reachable through the terminal and the exec API — rendering
those as first-class pages is the roadmap, not a
shipped feature.
tmux-backed sessions mean every tool is already reachable — vim, htop, anything — with zero per-tool work. Close the browser and the session survives. Hand-built panels become opt-in refinements rather than blockers, which turns an impossible scope into a tractable one.
A tool that edits files and runs processes is remote code execution by design. Renar does not amputate the dangerous rungs — it makes them accountable: capability grants, step-up re-proof, sandboxed plugins, recorded sessions, and a hash-chained ledger.
The interface, unretouched
fourteen screenshots of the running engine — arrow keys, or swipe
-
/
The console — folder sizes, search, upload, per-row actions. -
/README.md
Markdown rendered: tables, task lists, fenced code. -
/api/server.rs
Source — line numbers, anchors, 75 grammars. -
/run/build
A command's own colours, kept. Exit code and timing in the bar. -
/run/tail?lines=25
Commands take typed parameters — the result is a URL you can bookmark. -
/data/config.json
JSON as a panel you configure, with the source below it. -
/data/metrics.csv
CSV as a grid — numeric columns right-aligned, no spreadsheet. -
/run
Every declared command, how it renders, and the cage it runs in. -
/trash
Deletes go to a trash, not the void. -
/account
Your grants and sessions, per root. -
/data/tiles/12-2093-1403.png
Images get a viewer, not a download. -
/docs/architecture.svg
SVG previews — served as an image only to an <img>, never to a navigation. -
/web/styles.css
Stylesheets render for you and stay bytes for the browser. -
/help
Press ? anywhere. It describes this engine, not a generic one.
Every request is a capability question
Not a role. Not a global permission bit. Renar answers Account × Root × capability on every single request, and re-answers it after the path resolves.
A Root is a directory the engine serves. A Grant is the
capability set — read, write, exec, pty — an Account holds
on that specific Root. Subtree
.renar.toml files can only ever restrict further.
The dangerous rungs — PTY, exec, delete, minting a share — demand a fresh credential proof when the session is older than fifteen minutes. A stolen cookie is not a shell.
Path resolution goes through openat2 with
RESOLVE_BENEATH and a proof token the operations
layer demands. Escaping a Root is not something a clever
../ accomplishes.
Exec is an argv vector matched against an operator allowlist —
never a shell string. Submitting sh -c requires a
separately named Shell grant, and no other code path in the
engine constructs a shell invocation.
Append-only JSONL outside every served root, each record chained to the last, each carrying the ledger's own scope mode — so a reduced ledger is self-declaring and never mistakable for a full one.
Sidecars in any language over JSON-RPC on a Unix socket, default-deny capabilities, shipped as ed25519-signed packages, and held by Landlock plus a seccomp filter on the child.
Running in about a minute
no database, no reverse proxy required, no container needed
# serve a directory, right now $ renar /srv/notes --port 8080 # there is no unauthenticated mode — make the first operator $ printf 'a-long-password' | renar bootstrap-admin op \ --config /etc/renar.toml --password-stdin # then run it for real $ renar --config /etc/renar.toml
# /etc/renar.toml — the whole thing schema = 1 [[roots]] path = "/srv/notes" label = "notes" [stores] dir = "/var/lib/renar" # tier presets pick every security default; # each one stays admin-tunable afterwards. [posture] tier = "t1"
libc,
libm and libgcc_s — nothing else. No
runtime, no interpreter, no sidecar database. Terminal sessions want
tmux on the host; everything else is in the binary.
Open core, honestly drawn
The free core is genuinely the product. The paid edition sells what a rebuild cannot reproduce — signed builds, updates, support — never a patchable license field.
- Rendering, editors, upload, rename, delete with trash
- Accounts, per-root grants, sessions, step-up
- Hash-chained ledger, expiring share links, WebDAV mount
- tmux terminal, argv exec, content search, disk usage
- In-binary TLS 1.3 with hybrid post-quantum key exchange
- Everything in the core, plus the gated capability catalog
- Signed release builds and an update channel
- SSO breadth: OIDC, SAML, LDAP, Kerberos, trusted proxy
- Fleet view: signed status envelopes across your boxes
- Support, and the ceremony docs for issuing your own keys
Same codebase, one binary, one feature flag. Pro €29 and Team €99 per install per month, a €349/year small-business licence, Enterprise from €6,000/year — all excluding VAT. See the full ladder and what the OSS core includes.
Where it actually is
the part most landing pages leave out
It runs, it is tested hard, and it is not battle-scarred yet. The author's own tailnet box is the first real deployment. If you need something that a thousand shops have already broken in, that is a completely reasonable thing to want, and it is not this — yet.
1,217 tests across the workspace. Twenty-two rounds of adversarial review by several independent models, each finding recorded and fixed with a regression test. Clippy at deny-warnings, a dependency audit, and a licence gate in the pipeline.
No third-party security audit yet. The Kerberos verifier is RFC-conformant by construction but has not met a production KDC. Some capability ceilings are enforced at one door and not another. Those are written down, not buried.
Point it at a directory.
Then read the ledger and see exactly what it did.