Projects

The full register. Product-facing descriptions live on oesalabs.com; this page carries the engineering facts.

Fairview

Beta

A local-first control plane for AdGuard Home fleets.

Status
Beta
Availability
Not yet public
Licence
Licence not yet settled. Fairview is not open source today.
Stack
Elixir, Phoenix LiveView, PostgreSQL, Oban, Docker Compose, Nix
Group
Operator tools
Source
Publishes to github.com/oesalabs when public

Security posture

  • Writes to DNS servers are disabled until explicitly enabled with a configuration flag, and nothing changes without an approved plan.
  • Binds to loopback by default; no public registration or password recovery paths.
  • Connector secrets are encrypted at rest with AES-256-GCM, with documented key rotation.

Known limits

  • Designed for local operation. Exposing it beyond your network requires your own reverse proxy and TLS, following the documented posture guidance.
  • The source is not yet published and the licence is not yet decided.
  • Optional UniFi visibility and AI summaries stay off unless you turn them on.

Full project page

Summit

Beta

A self-hosted home for bookmarks and browser state, with an openly specified sync protocol.

Status
Beta
Availability
Source release planned
Licence
Apache-2.0. Public source release is planned; the repository is private today.
Stack
Elixir, Phoenix, PostgreSQL, Oban, React PWA, TypeScript CLI, Browser extensions
Group
Personal computing
Source
Publishes to github.com/oesalabs when public

Security posture

  • Argon2id credential hashing, opaque sessions and tokens, recovery codes, TOTP, and rate limiting are implemented and tested.
  • Link and metadata probes are SSRF-guarded with DNS, IP, and redirect controls and bounded HTML handling.

Known limits

  • Approaching 1.0: phases 0 through 8 of the reference product are complete, but there is no tagged release yet.
  • Optional modules such as federation, OIDC, end-to-end encryption, and plugins are feature-gated and some are experimental.
  • Shared or networked use requires you to set strong credentials during setup.

Full project page

lakeloui.se

Production

A live mountain weather and snow report for Lake Louise, built on Canadian forecast models.

Status
Production
Availability
Live service
Licence
Operated as a service; the code is not distributed.
Stack
TypeScript, AWS Lambda, S3 and CloudFront, DynamoDB, Terraform, HRDPS, RDPS, and GDPS models
Group
Live systems
Source
Operated service: lakeloui.se

Security posture

  • Static delivery with a strict Content Security Policy; the admin surface is restricted by network policy.

Known limits

  • Covers one place by design: Lake Louise.
  • Upstream data sources carry their own terms and attribution requirements.
  • It is an operated service, not software you can install.

Full project page

Timberline

Active development

A secure publishing platform that turns a private CMS into immutable public releases.

Status
Active development
Availability
Not yet public
Licence
Private for now; licensing is not yet decided.
Stack
TypeScript, Payload CMS, Astro, PostgreSQL, Playwright, Docker Compose
Group
Operator tools
Source
Publishes to github.com/oesalabs when public

Security posture

  • Strict package boundaries keep admin, worker, and public surfaces separated.
  • Preview links are authenticated, scoped, and marked noindex.

Known limits

  • In active development with no public release or decided licence.
  • WordPress import does not yet map every Gutenberg block type or SEO plugin field.
  • Continuous integration currently runs manually rather than on every push.

Full project page

Pika Suite

Active development

A private-first personal cloud: mail, calendars, contacts, tasks, notes, and files on one backend.

Status
Active development
Availability
Source release planned
Licence
AGPL-3.0-only. A public source launch is planned and gated on a release-readiness checklist; there is no supported public release today.
Stack
Elixir, Phoenix, PostgreSQL, React, Electron, IMAP, SMTP, JMAP, CalDAV, CardDAV, WebDAV
Group
Personal computing
Source
Publishes to github.com/oesalabs when public

Security posture

  • A root security policy defines private reporting, supported-version truth, and redacted diagnostics.

Known limits

  • No supported public release yet; main and any alpha artifacts may change without notice.
  • The public AGPL launch is planned and explicitly gated on release-readiness evidence, including security review and signed artifacts.
  • Provider and client compatibility claims wait for dated evidence.

Full project page

SwiftSync

Active development

A private, self-hosted workspace for notes, planning, and AI chat.

Status
Active development
Availability
Source release planned
Licence
MIT. Public source release is planned; the repository is private today.
Stack
SvelteKit, Svelte 5, TypeScript, Dexie, PocketBase, Docker Compose
Group
Personal computing
Source
Publishes to github.com/oesalabs when public

Security posture

  • Server proxies are authenticated and guarded against SSRF, with private address blocking and redirect revalidation.
  • The security policy candidly documents remaining limits rather than claiming completeness.

Known limits

  • Built for a single operator; some multi-user scenarios are explicitly cautioned against in the security notes.
  • No public releases yet.
  • Direct vendor adapters beyond OpenRouter and local servers are planned, not built.

Full project page

Marmot Watch

Early development

A security-first inbox for web change: feeds, page watches, releases, certificates, and more.

Status
Early development
Availability
Not yet public
Licence
Licence not yet settled. Not open source today.
Stack
Elixir, Phoenix LiveView, PostgreSQL, Oban, Go workers, Chromium
Group
Operator tools
Source
Publishes to github.com/oesalabs when public

Security posture

  • Fetch diagnostics record resolver security decisions and blocked fetches.
  • Ingest tokens are hashed per source, and notification configuration is redacted in exports.

Known limits

  • Early development: the project describes itself as a working scaffold.
  • No hosted continuous integration or release artifacts yet.
  • Licence not yet decided; source not published.

Full project page