Glossary
Quick definitions for the terms and components you’ll meet across these docs.
Core terms
AnvilBase — a self-hostable Backend-as-a-Service platform: Postgres + REST + auth + realtime + storage + functions + queues + cache + secrets, multi-project, from one deployment.
Deployment / instance — one running AnvilBase stack (a Docker Compose project or Helm release). Hosts many projects.
Control plane — the central Rust/Axum service. Authenticates requests, enforces isolation, routes to services, and contains the REST→SQL engine.
Project — an isolated tenant: its own database, storage bucket, JWT secret, and API keys. Identified by a UUID and a slug.
Management plane — the control surface, /api/v1/*. Admin token / PAT.
Data plane — the application surface, /v1/*. Project API keys / user JWTs.
REST→SQL engine — the built-in, PostgREST-compatible REST API. Serves all projects from one binary via lazy ~2–5 MB per-project connection pools (replaces per-project PostgREST processes).
Isolation — complete, cross-layer separation between projects (database, bucket, secret, cache namespace, queue namespace), enforced at routing and again by RLS.
Credentials & keys
Anon key (anvilbase_anon_…) — public, client-side data-plane key. RLS-limited.
Service role key (anvilbase_service_role_…) — server-side data-plane key that
bypasses RLS. Treat like a DB password.
JWT — a signed token issued to an end user by Better Auth, carrying the
authenticated scope and user id.
JWT secret — per-project signing secret for JWTs (rotatable).
PAT (Personal Access Token) (anvilbase_pat_…) — a management-plane credential.
Admin token — the ANVILBASE_ADMIN_TOKEN value; the root management credential.
Scope — anon / authenticated / service_role; determines RLS treatment.
Security
RLS (Row Level Security) — per-row Postgres policies; the primary data-access control, enabled by default on every created table.
Secrets vault — encrypted per-project store for your application’s secrets (pgcrypto); values never returned by the API.
Audit log — immutable, append-only record of administrative actions.
RBAC — platform operator roles (super_admin, project_admin, developer,
viewer) and project membership roles (owner, admin, editor, read_only).
SSRF guard — protection that blocks webhook targets resolving to internal / metadata addresses.
eIDAS 2.0 — EU Digital Identity; AnvilBase can verify and issue Verifiable Credentials with EUDI Wallets.
Components
| Term | What it is |
|---|---|
| Traefik | reverse proxy; edge TLS termination |
| Better Auth | the authentication service (TypeScript) |
| Phoenix | Elixir realtime engine (Channels/Presence) |
| MinIO / RustFS | S3-compatible object storage backends |
| Deno | the edge-function runtime (one isolated process per project) |
| PGMQ | Postgres-native message queues |
| Valkey | Apache-2.0 Redis fork; cache + rate limiting |
| Supavisor | Postgres connection pooler (Elixir) |
| pgvector | vector similarity search extension |
| pgcrypto | encryption / secrets extension |
| pg_cron | in-database job scheduler |
| pg_net | outbound HTTP from SQL |
| imgproxy | on-the-fly image processing |
| wal-g | WAL archiving for point-in-time recovery |
| MCP server | @glesumdev/anvilbase-mcp; drives AnvilBase from AI tools |
Operations
PITR (Point-in-Time Recovery) — restore the database to any timestamp in the WAL archive window (via wal-g).
RPO / RTO — Recovery Point Objective (max acceptable data loss) / Recovery Time Objective (max acceptable downtime).
mTLS — mutual TLS between internal services (opt-in).
Quota — per-project limits (max_db_size_mb, max_storage_size_mb,
max_edge_function_count); breaches return 429.
Environment (anvilbase.toml) — a named target deployment (dev/staging/prod) for
CLI deploy/env commands.
License
BSL 1.1 (Business Source License 1.1) — AnvilBase’s license. Source-available: anyone can read, audit, and self-host for non-commercial use. The commercial restriction prevents cloud providers from offering it as a managed service without a license. Each release converts to Apache 2.0 four years after publication. Precedent: CockroachDB, Sentry, Materialize, MariaDB.
Back to the documentation home.