Your rivals aren't rebuildingthe backend.They're shipping past you.
Auth, RBAC, multi-tenancy, audit, billing, files, realtime, messaging and notifications — the plumbing every serious product needs and no customer pays extra for. Nucleus turns all of it into a single configuration object. Months of backend engineering become a set of documented keys.
1{2 "appId": "storefront",3 "database": { "url": "DATABASE_URL" },4 "redis": { "url": "REDIS_URL" },5 "authentication": { "enabled": true, "mode": "full" },6 "authorization": {7 "enabled": true,8 "autoSeedClaims": true9 },10 "storage": { "enabled": true },11 "entities": [12 { "table_name": "products", "add_base_columns": true },13 { "table_name": "orders", "add_base_columns": true }14 ]15}This is the whole backend — auth, RBAC, storage & typed CRUD, generated.
- config keys replace months of backend work
- 25
- command scaffolds API, frontend, k8s & pipelines
- 1
- type-safe from database to frontend
- 100%
- lines of auth, RBAC or audit code to write
- 0
No magic · no lock-in
Built on the stack you'd have chosen anyway.
Nucleus is a thin, generated layer over boring, battle-tested tools. Your data is plain PostgreSQL. Your API is a plain Elysia app. You can read every table and drop down to raw code whenever you want.
- BunRuntime
- ElysiaHTTP framework
- Drizzle ORMType-safe SQL
- PostgreSQLYour database
- RedisSessions & cache
- TypeBoxRuntime validation
- OpenAPIAuto Swagger
- DaprOptional sidecar
- ReactFrontend kit
- KubernetesShip anywhere
Trusted in production
Teams shipping on Nucleus.
- KARSAN
- TATMETAL
- TOFAŞ
- BILTIM
- FARPLAS
- HUMANIS
- VORION
What it actually costs to build it yourself
The most expensive code is the code you never needed to write.
Rebuilding the backend feels like progress. On the balance sheet, it is risk, burn and delay — three lines no one wants to defend in a review.
Undifferentiated burn
Every sprint spent on login, permissions and audit logs is payroll spent on plumbing no customer will ever pay you extra for. It is pure cost of doing business — and you are absorbing all of it.
0% of it is your product
Breach exposure
Hand-rolled authentication and authorization is where incidents begin. One missed token check or scope leak turns into a board-level disclosure, a regulatory letter and a number you will report for years.
one bug, one incident
Opportunity cost
While your team rebuilds the same backend for the third time this decade, your competitors ship the feature that wins the deal. Runway does not pause for plumbing.
months, not features
Forever maintenance
DIY infrastructure is never finished when it ships. It is a permanent line item — patched, on-called and worried about — long after the engineers who built it have moved on.
you own it forever
From config to running API in three steps
Declare it. Generate it. Mount it.
No scaffolding to wire by hand, no boilerplate copied between services. One command runs all three — bunx nucleus-core-ts init --preset saas --app-id shop -o ./shop writes the config, generates the schema and mounts the plugin. The steps below are what it produces, and what you wire yourself when Nucleus goes into a service you already have. The same loop scales from a weekend prototype to a multi-tenant production system.
Declare your backend as config
One JSON object describes your entities, auth, permissions, storage and integrations. Secrets are env-var names, so the exact same file ships to every environment.
{ "appId": "storefront", "database": { "url": "DATABASE_URL" }, "redis": { "host": "REDIS_HOST", "port": "REDIS_PORT" }, "authentication": { "enabled": true, "mode": "full" }, "authorization": { "enabled": true, "autoSeedClaims": true }, "entities": [ { "table_name": "products", "add_base_columns": true, "columns": [ { "name": "title", "type": "text" }, { "name": "price", "type": "numeric" }, { "name": "published", "type": "boolean" } ] } ]}Generate the schema
One command turns the config into a Drizzle schema, merging your tables with the built-in system tables — users, sessions, roles, claims and audit_logs.
$ bunx nucleus-core-ts generate src/config.json src/drizzle ✓ products ✓ users ✓ sessions ✓ roles ✓ claims ✓ audit_logs schema + relations writtenMount one plugin
Hand the schema to NucleusElysiaPlugin. Every enabled feature's routes, validation, claims and OpenAPI docs mount themselves — and you can add your own routes right alongside.
import { Elysia } from "elysia";import { NucleusElysiaPlugin } from "nucleus-core-ts"; new Elysia() .use(await NucleusElysiaPlugin({ options: "./src/config.json", schema: "./src/drizzle/schema.ts", relations: "./src/drizzle/relations.ts", swagger: { path: "/docs" }, })) .listen(9000);Show, don't tell
One table declaration. A complete, secured API.
Add an entity and Nucleus generates CRUD routes, a full query language, runtime validation, RBAC claims, OpenAPI docs and a fully-typed client action — all at once, all consistent.
Add a table to your config — columns, base columns, bulk endpoints. That is the entire input.
{ "table_name": "posts", "add_base_columns": true, "bulk_endpoints_enabled": true, "columns": [ { "name": "title", "type": "text" }, { "name": "body", "type": "text" }, { "name": "published", "type": "boolean", "default": false } ]}What one config object already does
Everything below ships the day you start. Not the quarter you finish.
Each of these is a documented config key or a generated surface — production-grade, secured and typed. Open any one to see exactly how it works.
Authentication
JWT, multi-device sessions, magic links, passkeys, OAuth (with profile sync) and captcha — the entire credential lifecycle, hardened.
Authorization
RBAC with auto-seeded claims and row-level scopes the instant you declare a table. No permission code to write.
Guardrails & service auth
API keys for service-to-service calls, a claim per endpoint discovered from any OpenAPI service and enforced at the bundled proxy, and usage or spend guards that suppress those claims the moment a limit is hit.
Multi-tenancy
Schema-isolated tenants from day one — not a painful rewrite you postpone until your first enterprise contract.
Realtime & pub/sub
WebSocket events, presence and topic fan-out with ACK and redelivery — a live socket your frontend reads with a single hook.
Chat & messaging
1:1 and group conversations with typing, read receipts and attachments — plus a drop-in ChatPanel. Messaging without a messaging service.
Notifications
Portal, email, Telegram and webhook delivery from one call — with a ready notification center and unread badge for the frontend.
Audit trail
Every change recorded automatically, with old/new diffs and secret redaction. Compliance evidence by default, not a frantic pre-audit project.
Backups & restore
Scheduled backups with retention and one-call restore endpoints — recoverable by default, not a project you keep postponing.
Verification flows
Visual, multi-step approval workflows over any record — drawn once, enforced everywhere.
Payments & marketplace
iyzico and Stripe wired to your entities — 3-D Secure, saved cards and subscriptions, plus a marketplace money layer with commission splits, reserves and payouts.
Storage & media CDN
Uploads with MIME guards, an on-the-fly image and video pipeline (resize, WebP/AVIF, transcode, posters) and a range-aware CDN — on local disk or SMB.
Custom domains
Let tenants bring their own domain — live DNS verification, SSL provisioning and full-hostname routing for true white-label.
Query API
Filter, sort, paginate and expand relations over every table. Zero endpoints to write or maintain.
Typed client
Every route becomes a fully type-safe action in your frontend — payloads and responses inferred, end to end.
Frontend kit
Login, profile, RBAC console, chat, notifications, data tables and form builders — themeable React components, already shipped.
Rate limiting
Sliding-window, token-bucket and per-auth-route limits with brute-force lockouts — abuse protection you switch on, not build.
Live config control
Read the running configuration with every secret masked, hot-patch a section and flip features at runtime — without a redeploy.
Logs & tracing
Structured logs with levels and scope filters, x-request-id tracing across every request, slow-request detection and sensitive-key redaction.
Metrics & alerts
System, application, database and Redis metrics with persisted history, threshold alerts over email and a live SSE stream to drive a dashboard.
One command
Scaffold the API, the frontend, Kubernetes manifests and CI pipelines in a single CLI run.
Build vs. buy · line by line
What you'd write yourself vs. what you declare.
Everything on the left is code you own, test, secure and maintain forever. Everything on the right is a configuration key.
- Authentication & sessionsDo it yourself: Weeks of token, cookie & device logicWith Nucleus: authentication: { enabled: true }
- Role-based access controlDo it yourself: Custom middleware on every routeWith Nucleus: Claims auto-seeded per table
- Multi-tenancyDo it yourself: A painful rewrite you postponeWith Nucleus: Schema-isolated from day one
- Audit loggingDo it yourself: Bolt-on, easy to forgetWith Nucleus: Every change recorded by default
- List & query endpointsDo it yourself: Hand-rolled for every entityWith Nucleus: 15-operator query language, free
- Input validationDo it yourself: Manual schemas that driftWith Nucleus: TypeBox generated from the table
- Typed API clientDo it yourself: Hand-maintained, goes staleWith Nucleus: Inferred end-to-end, always in sync
- Logging & tracingDo it yourself: console.log archaeologyWith Nucleus: Scoped logs + request ids, built in
- Realtime & chatDo it yourself: A WebSocket server, presence & ACK/retryWith Nucleus: pubsub + chat config keys
- NotificationsDo it yourself: Per-channel senders you wire and retryWith Nucleus: Portal, email, Telegram, webhook — one call
- File uploads & mediaDo it yourself: Upload handling, MIME checks, image/video jobsWith Nucleus: Storage + transform config, CDN included
- Rate limiting & abuseDo it yourself: Custom counters and lockout logicWith Nucleus: Strategy + per-route limits, declared
- Time to first endpointDo it yourself: DaysWith Nucleus: Minutes
- Who maintains itDo it yourself: You, foreverWith Nucleus: A versioned package
The AI era doesn't wait for your backend.
Idea-to-product collapsed from quarters to days. The teams pulling ahead treat infrastructure as a solved problem and spend every hour on what's actually different about their product.
If your engineers are still wiring sessions and permission scopes by hand, you're running the AI race on foot — and the gap to whoever isn't doesn't close. It compounds.
The cost of “we'll just build it ourselves” has never been higher, precisely because the alternative has never been this fast.
Before you ask
The questions every engineer asks first.
No. Your data lives in plain PostgreSQL tables you can read, back up and migrate like any other. Nucleus generates a standard Drizzle schema and a normal Elysia app — drop down to raw SQL or hand-written routes whenever you want. Yes. NucleusElysiaPlugin mounts into an ordinary Elysia app, so you add routes, middleware and services next to it exactly as in any Elysia project. Nucleus owns the boilerplate; you own the product. No — that's the starting point. The same config object also gives you realtime pub/sub and chat, multi-channel notifications (portal, email, Telegram, webhook), payments with a full marketplace money layer, file storage with an image/video CDN pipeline, custom domains for white-label tenants, scheduled backups, rate limiting, an encrypted secrets store and live config, and API keys plus per-endpoint claims and usage guards for the non-Nucleus services you already run — on top of audit, monitoring and a typed React frontend kit. It's a whole backend, not a login box. Bun and Elysia for the API, Drizzle ORM over PostgreSQL, Redis for sessions, cache and realtime pub/sub, TypeBox for runtime validation, and an auto-generated OpenAPI/Swagger surface. Realtime rides WebSockets, optionally over a Dapr sidecar for pub/sub, secrets and state. The frontend kit is React. The components are fully themeable React building blocks — login, profile, an RBAC console, data tables and form builders — driven by the same config. Use them as-is, restyle them, or ignore them entirely and call the typed client from your own UI. It's built for it. Production mode hardens cookies and logs, Redis backs sessions, and the CLI scaffolds Kubernetes manifests and CI pipelines so a new service is deployable on day one. Declaring a table auto-seeds RBAC claims for it, every query is parameterised (injection-safe by construction), and audit logging records changes by default. Auth covers JWT access/refresh/session tokens, password policy, email verification and captcha.
Talk to the team
Ship your backend with Nucleus
Three quick steps. Tell us what you're building and we'll show you the fastest path from config to production.
Reply within 1 business day
A real engineer, not an autoresponder.
Your data stays private
We never sell or share your information. NDA on request.
Talk to the maintainers
Straight to the people who build Nucleus.
Stop rebuilding the backend. Start shipping the product.
Every day spent reinventing infrastructure is a day a faster team spends on what makes them different. Tell us what you're building and we'll show you exactly what one config object already replaces.