Architecture
How the PNeX stack fits together
PNeX is a single Rust workspace. The same types (pnex-core) compile natively for
the server and to WebAssembly for the web app, so the client-server contract is
checked at compile time. The same UI code also ships as native apps for Linux,
Windows and Android.
Explore the architecture
Click a block for details, follow a request end to end, or light up each security layer.
Components
| Component | Technology | Role |
|---|---|---|
| TLS edge | nginx | HTTPS (443) for browsers and native apps, local CA or Let's Encrypt; dedicated device endpoint (4443) over mutual TLS, a client certificate per device |
| Server | Loco (Axum, SeaORM) | REST + WebSocket API, workers, firmware build service |
| Web, desktop & mobile apps | Dioxus (Rust) | Every user-facing screen from one codebase: web (WebAssembly), Linux desktop (x86_64, ARM64), Windows desktop (x86_64), Android |
| Flow runtime | vendored EdgeLink, headless Rust binary | Executes visual flows, supervised and hot-reloaded by the server |
| Telemetry | OpenObserve | Metrics and logs, per-organization isolation |
| Live cache | Valkey | Instant last-value reads for charts, device presence, flow shared memory |
| Identity | Rauthy | OIDC single sign-on, JIT provisioning |
| Object storage | Any S3-compatible store (RustFS bundled) | Firmware artifacts, media library, camera recordings, documents |
| Vision & speech | ONNX models run in Rust (tract), sherpa-onnx / whisper.cpp | Object detection and tracking, training of custom detectors, transcription; no Python anywhere |
| Thermophysics | CoolProp (vendored C++), in-process | Fluid properties inside flow nodes and diagrams |
Three data bricks
PNeX needs exactly three data bricks: PostgreSQL (configuration, assets and the job queue), OpenObserve (time series and logs) and Valkey (live last values). Queue and workflow needs are covered by Postgres-backed workers and the flow runtime itself. PostgreSQL is the only supported database.
Files (firmware images, media, recordings, documents) go to an S3-compatible object store: the installers bundle RustFS, and any other S3-compatible service works. The older local-disk mode is being retired: start new installations on S3.
Server and edge split
The server stores data, builds firmware, casts configurations and never writes pins on its own. Today devices run in connected mode: flows drive them through the server. Autonomous devices — configuration cast onto the device, local regulation that survives server or internet outages — are coming, followed by a device-to-device mesh. See flows.
Edge agents
Computers and Raspberry Pis join PNeX as edge agents, on the same model as the
boards: at enrolment the agent receives a client certificate (previous ones are
revoked) and the name of the device endpoint; it connects there over https only,
with mutual TLS (rustls), then opens the same Noise link. After upgrading past
0.1.0-beta.7, re-enrol every agent.
See Self-hosting for deployment options per tier.