SOMA-Control
One binary. IAM + Vault + Feature Flags + Licensing.
Replaces: Auth0, HashiCorp Vault, LaunchDarkly, custom entitlement logic
Key components
| Component | What it is | Status |
|---|---|---|
| soma-control | Single Axum binary booting all four services on one port; WASM dashboards embedded via rust-embed | shipped |
| soma-iam | 216 routes, 37 modules; WebAuthn, SAML, OIDC, SCIM 2.0, TOTP, email OTP, device flow, M2M tokens, RBAC | shipped |
| soma-vault | Envelope encryption (AES-256-GCM, AES-KW), transit encryption, JSON Schema validation | shipped |
| soma-flags | Redis pub/sub propagation, multi-environment, segments, change-request workflow; TypeScript/Python/Go SDKs | shipped |
| soma-licensing | Plans, usage meters, coupons, addons, webhook delivery | shipped |
| Dashboards | 4 Leptos WASM dashboards (IAM 30 pg / vault 15 / flags 10 / licensing 11); embedded in the binary | shipped |
| Client SDKs | TypeScript IAM+vault, Python vault+flags, Go vault+flags | usable |
| Terraform provider + GitHub Action | Declare SOMA resources as IaC; inject vault secrets into CI | usable |
| Deployment artifacts | Helm chart for vault, AWS Dockerfile + scripts, Docker Compose | usable |
Why it matters
- →Four enterprise services in one Rust binary — no Docker Compose mesh for the control plane
- →WebAuthn/Passkeys, SAML, OIDC, SCIM 2.0, and TOTP all ship in IAM out of the box
- →Dashboards compile to WebAssembly, embedded in the binary — no CDN, no Node.js runtime
- →All crypto is pure Rust, OpenSSL-free: AES-256-GCM, ECDSA P-256, Argon2, HKDF, AES-KW
- →#![forbid(unsafe_code)] on every server crate
Maturity
Git activity
80 commits over 14 days (2026-07-16 to 2026-07-30), ~6 commits/day. DevKit submodule: 19 commits over the same window.