SOMA-Control
One binary. IAM + Vault + Feature Flags + Licensing.
Replaces: Auth0, HashiCorp Vault, LaunchDarkly, custom entitlement logic
- Routes
- 3414 services
- Idle RSS, measured
- 5.15MiB
- OpenSSL in build
- 0pure-Rust crypto
- Dashboards
- 4embedded WASM
Four vendors' products, as rings of one process
IAM, secrets, flags, and licensing share one port, one Axum router, and one Postgres pool. The dashboards compile to WASM and travel inside the binary. Each service has its own deep-dive page:
216 routes · WebAuthn to SCIM
envelope encryption · transit API
real-time flags · 3 SDKs · sub-ms eval
plans · meters · entitlement webhooks
The full authentication surface, out of the box
Everything below ships enabled in soma-iam — none of it is a tier, an add-on, or a partner integration.
The box, itemized
Same capability, two ways to get it. The right column names the structural cost of the usual route — the tier it's gated behind or the infrastructure it drags in — not a price quote.
| Capability | soma-control | The usual route |
|---|---|---|
| Identity — soma-iam | ||
| WebAuthn / Passkeys | in the box | MFA add-on tier on IdP SaaS |
| SAML 2.0 + OIDC provider | in the box | the "SSO tax" tier |
| SCIM 2.0 provisioning | in the box | enterprise tier |
| TOTP · email OTP · device flow | in the box | assembled from add-ons |
| Multi-tenant RBAC + deny overrides | in the box | custom code on top of the IdP |
| Secrets — soma-vault | ||
| Envelope encryption (AES-256-GCM + AES-KW) | in the box | a Vault cluster, or KMS lock-in |
| Transit encryption API | in the box | a Vault deployment |
| JSON Schema validation of secret shape | in the box | convention and hope |
| Feature flags — soma-flags | ||
| Real-time propagation (Redis pub/sub) | in the box | seat-priced flag SaaS |
| Segments · multi-env · change requests | in the box | higher seat-priced tiers |
| TypeScript / Python / Go SDKs | in the box | included, but MAU-metered |
| Licensing — soma-licensing | ||
| Plans · usage meters · coupons · addons | in the box | a billing SaaS, or a custom build |
| Entitlement webhooks with delivery | in the box | custom glue code |
Honesty note — not in the box: an enterprise SSO partner ecosystem, compliance paperwork, or a support organization. Client SDKs and the Terraform provider are beta (see maturity below). The surface above is aimed at a startup running for years without switching — not at feature-count parity with any incumbent.
The control plane, priced in RAM
Self-hosting the same three concerns the conventional way, using each vendor's own documented minimums, at idle:
| Concern | The usual answer | Documented minimum |
|---|---|---|
| Identity | Keycloak | 1,250 MB/pod · min. 2 services · external DB |
| Secrets | Infisical | ~16 GB across 3 services (app + PG 8 GB + Redis 4 GB) |
| Feature flags | GrowthBook | 2 GB / 1 vCPU × 3 instances + MongoDB |
| Licensing | typically SaaS-only | no self-hosted option to size |
| All four | soma-control | 5.152 MiB idle, measured · one process · one Postgres |
Vendor minimums are for idle/light load and grow with usage; they are sizing guidance, not benchmarks. soma-control figure measured on linux/arm64, 2026-07-31, commit de4f858 — methodology at soma.dev/footprint. Sources: keycloak.org · infisical.com/docs · growthbook.io.
Identity, head to head
The identity slice alone, against the tools people actually shortlist — the three big SaaS providers and the seven most-deployed open-source servers. Figures are each vendor's own documented minimums or sizing guidance, at idle.
| Tool | Runtime | Documented minimum / model | Brings along |
|---|---|---|---|
| Paid SaaS — nothing to self-host, nothing to measure | |||
| Auth0 | SaaS | billed per monthly active user | vendor lock-in at the login box |
| Okta | SaaS | billed per user / month | per-feature add-on pricing |
| Microsoft Entra ID | SaaS | per user / month (P1 / P2 tiers) | Microsoft ecosystem coupling |
| Self-hosted open source — the top 7 | |||
| Keycloak | JVM | 1,250 MB/pod · min. 2 services | external database |
| Authentik | Python | 2 cores · 2 GB minimum | Postgres + Redis, server + worker |
| FusionAuth | JVM | 512 MB–1 GB/node · 2 GB+ with threat detection | external database |
| Zitadel | Go | 512 MB test · 2–4 cores + ~4–6 GB advised for prod | Postgres |
| Logto | Node | 512 MB min · 1 GB recommended | Postgres |
| SuperTokens | JVM core | ~1 GB-class instance per vendor guidance | Postgres · headless core |
| Ory Kratos | Go | no published minimum — small Go binary | Postgres · headless, bring your own UI |
| soma-iam | Rust | 5.152 MiB idle · 0.282 s startup — measured | one Postgres — and the figure includes vault, flags, and licensing |
Fairness notes: Zitadel and Ory are also lean Go servers — the gap there is scope and surface, not runtime weight. Vendor figures are their own published minimums or sizing guidance for idle/light load and grow with usage. soma-control's figure is measured idle RSS (linux/arm64, 2026-07-31), not a load benchmark. A detailed load, scaling, and performance analysis is planned; every result will publish at /footprint with reproducible scripts — nothing appears in these tables before it is measured. Sources: keycloak.org · goauthentik.io · fusionauth.io · zitadel.com · docs.logto.io · supertokens.com · ory.com · Auth0/Okta/Entra pricing pages (billing unit only).
Key components
| Component | What it is | Status |
|---|---|---|
| soma-control | Single Axum binary booting all four services on one port; WASM dashboards embedded via rust-embed | shipped |
| soma-iam | 216 routes, 37 modules; WebAuthn, SAML, OIDC, SCIM 2.0, TOTP, email OTP, device flow, M2M tokens, RBAC | shipped |
| soma-vault | Envelope encryption (AES-256-GCM, AES-KW), transit encryption, JSON Schema validation | shipped |
| soma-flags | Redis pub/sub propagation, multi-environment, segments, change-request workflow; TypeScript/Python/Go SDKs | shipped |
| soma-licensing | Plans, usage meters, coupons, addons, webhook delivery | shipped |
| Dashboards | 4 Leptos WASM dashboards (IAM 30 pg / vault 15 / flags 10 / licensing 11); embedded in the binary | shipped |
| Client SDKs | TypeScript IAM+vault, Python vault+flags, Go vault+flags | usable |
| Terraform provider + GitHub Action | Declare SOMA resources as IaC; inject vault secrets into CI | usable |
| Deployment artifacts | Helm chart for vault, AWS Dockerfile + scripts, Docker Compose | usable |
Why it matters
- →Four enterprise services in one Rust binary — no Docker Compose mesh for the control plane
- →WebAuthn/Passkeys, SAML, OIDC, SCIM 2.0, and TOTP all ship in IAM out of the box
- →Dashboards compile to WebAssembly, embedded in the binary — no CDN, no Node.js runtime
- →All crypto is pure Rust, OpenSSL-free: AES-256-GCM, ECDSA P-256, Argon2, HKDF, AES-KW
- →#![forbid(unsafe_code)] on every server crate
Maturity
Git activity
80 commits over 14 days (2026-07-16 to 2026-07-30), ~6 commits/day. DevKit submodule: 19 commits over the same window.