The machine,
rendered.
Renar is one static binary that turns a directory tree — then the terminals, tools, and services around it — into live, themed HTML. Accounts, per-root grants, and a hash-chained audit ledger are built in. Expiring share links and a WebDAV mount come free in every edition. No runtime dependencies, no CDN assets, no third-party crypto.
~/srv/notes
| name | kind |
|---|---|
- 07:42:05 read ok op /srv/notes/README.md #9f3c21ab
an interactive sketch of the interaction — the screenshots below are the real interface.
Not another dashboard
the thesisEvery web console you have used is a hand-built dashboard: each feature manually constructed, each one aging the day it ships. Renar is a rendering engine for the machine — the filesystem, the processes, the services, and any CLI utility become live, themed HTML through one engine and one plugin contract.
tmux-backed terminal sessions mean every tool is already renderable — vim, htop, anything — with zero per-tool work. Hand-built panels become opt-in refinements, never blockers. That one decision converts an impossible scope into a tractable one.
A tool that edits files and runs processes is RCE by design. Renar does not amputate the dangerous rungs — it makes them accountable: capability grants, step-up re-proof, signed plugins, recorded sessions, a hash-chained ledger. Server-rendered HTML, no SPA, strict CSP — and every surface keeps a JSON twin for scripts.
The real interface
unretouched screenshotsThese are screenshots of an actual Renar instance serving a demo tree — the default theme, the shipped binary, nothing staged. Renar's own UI is deliberately plain: server-rendered HTML that respects your browser's defaults, fast on anything that can open a page.
?raw=1 away
Security is the product
asset → adversary → answerSecure the rungs. Don't amputate them. Other file tools removed shell execution to be safe, and became file panes with previews. Renar keeps the rungs — exec, terminal, write — and wraps each one in a capability architecture: granted per account per root, re-proved on the dangerous rungs, recorded in a ledger whose tampering is detectable.
The full model — adversaries, answers, and what we refuse to claim →
Two editions, one codebase
degrades, never crashesThe edition is chosen at compile time and enforced by a signed license gate. The free edition is deliberately generous — everything a single box needs, including accounts, plugins, exec and the ledger. Enterprise adds the multi-box and regulated surface.
- The whole single-box surface: renderers, write path, search, du, exec, terminal, plugins
- Expiring shares, the WebDAV mount, video and audio previews — free, like doors should be
- Passkey / password+TOTP / PAM accounts, grants, ledger
- Signed release artifacts, both architectures
- The anchor-box case, fully usable — forever
- Fleet management, the verifier set (OIDC / proxy-header on Pro; LDAP, client mTLS on Team+; Kerberos, SAML at the top)
- Session recording, full-scope ledger
- A license may cap tier, accounts and roots; on-prem installs can issue their own against their own key
- Issued as an Ed25519-signed envelope, verified offline, self-declared on
/status
Where it stands
0.1.0 — the spine, completeEvery phase below is built, tested, and running in the current tree. Where something is planned rather than shipped, we say so.
Content-attack baseline: escaping, CSP, symlink policy, request caps.
In-binary hybrid-PQ TLS acceptor, accounts (passkey/TOTP/PAM), sliding sessions, step-up, grants, the hash-chained ledger.
PUT/DELETE/rename/mkdir, trash, uploads, editor profiles — riding grants and the ledger.
argv-only exec allowlists, tmux-backed PTY, session recording, the guarded capability.
Content search, du scans and the cleaner, live refresh, metrics.
Out-of-process SDK, Landlock/seccomp cage, signed packages, reference plugins.
Signed envelopes, fleet cards, the verifier set, offline revocation, break-glass.
Schema-driven panels, the plugin gallery tooling, and the five-stage CI gate that re-proves it all.