ARCHITECTURE & OVERVIEW

K.E.Y.S.T.O.N.E. is a self-hosted server and process management system written in Rust. A single web panel connects to any number of remote daemons, while each daemon manages processes, PTY terminals, files, native OS resource limits, and Lua 5.4 installers on its host.

[ BROWSER (Svelte 5 + xterm.js) ] │ ▼ HttpOnly Session + CSRF + WS Relay ┌─────────────────┐ │ PANEL (web) │ SQLite (Argon2id RBAC) + Presets + Fluent i18n └────────┬────────┘ ┌─────────┼─────────┐ ▼ ▼ ▼ Bearer Token (HTTPS REST + WSS Terminal) ┌───────┐ ┌───────┐ ┌───────┐ │DAEMON1│ │DAEMON2│ │DAEMON3│ Pipe / PTY + Sandboxed Lua 5.4 + FS Root └───┬───┘ └───┬───┘ └───┬───┘ ▼ ▼ ▼ [cgroups] [WinJob] [FreeBSD RCTL] ──► Managed Instances

SPECIFICATIONS

Component	Details
Backend	Rust (Axum, Tokio, SQLite)
Frontend	Svelte 5 + Vite + xterm.js
Auth & Access	Argon2id, CSRF, RBAC grants
Resource Limits	Linux cgroups v2, Windows Job Objects, FreeBSD RCTL
Presets	Embedded Lua 5.4 (64 MiB limit)
Platforms	Linux, Windows, BSD (x86_64, ARM64, ARMv7)

Downloads Lua Presets Documentation

KEY FEATURES

1. Process & PTY Control

Run processes in standard pipes or pseudo-terminals (Unix PTY / Windows ConPTY). Graceful stop via custom stdin command or ^C with timeout escalation, plus automatic restart with exponential backoff.

2. Native OS Resource Limits

Configure CPU quota in percent (100% = 1 logical CPU), logical CPU affinity, and memory limits directly via Linux cgroups v2, Windows Job Objects, and FreeBSD RCTL without Docker.

3. Lua 5.4 Presets

JSON field definitions (including cascading dynamic_enum options) combined with sandboxed Lua 5.4 hooks (build, install), SHA-256 verified streaming downloads, workspace file patching, and installer execution.

4. Multi-Node RBAC & Grants

The browser communicates only with the panel. Restricted users see only explicitly granted remote, instance, fs, and preset scopes.

5. File Manager & Streaming

Built-in text editor (up to 2 MiB) and streaming file upload/download (up to max_file_bytes) confined to the daemon's fs_root and user path grants.

6. Console Encodings & i18n

Separate input/output character encodings (utf-8, cp866, windows-1251) for legacy console applications, plus hot-reloaded Fluent (.ftl) locales.

QUICK START

1. Daemon

cp daemon.toml.example daemon.toml
./daemon daemon.toml

2. Panel

cp panel.toml.example panel.toml
cp remotes.toml.example remotes.toml
./panel account bootstrap --username admin
./panel