BuilderOps · tenancy service

Every build, accounted for — per user, per key, per turn.

Distro began as an in-browser AI app builder (the bolt.diy fork) and now ships the part that was always its own: the multi-tenant control plane. Accounts, one OmniRoute gateway key per user, quota and spend enforcement, an admin console — the tenancy layer the ecosystem's builder surface (Genie) calls for every model turn.

Get started Docs

$ git clone https://github.com/innotelinc/distro.git && cd distro && cp .env.example .env && ./scripts/bootstrap.sh

Per-user keysevery turn attributable

Quotas429 before tokens burn

OmniRouteone gateway, every provider

Auditedprovision · build · export

Tenancy for the builder surface.

One control plane between the builder and the gateway — so building stays one web UI, and spending stays everyone's own.

Identity → account

A signed-in Authentik subject resolves to a control-plane account on first sight — no duplicate accounts, no silent rebinds.

One key per user

The control plane mints, rotates and revokes each user's OmniRoute gateway key through the gateway's own dashboard API.

Quota at the turn

Quota is checked before each model turn and usage is reported after it — 429 before tokens burn, spend caps on the keys as the backstop.

Keys never leave the server

Builder traffic talks to your self-hosted OmniRoute gateway with the user's own key — upstream provider keys live in one place, never in the client.

Admin console

Per-user limits, enable/disable, revoke/rotate, roles, an audit log, and the historical builder-audit rows kept per user.

SSO & billing, optional

Cerulean Authentik identity and Magnate subscriptions from the platform stack — wired in, off by default.

How it got here.

Two MIT upstreams assembled into one service — then the surfaces other platforms own were handed back, and the tenancy layer is what ships.

bolt.diy · MIT · retired

The in-browser IDE — chat-to-code, WebContainer sandbox, live preview, file tree, terminal. Forked and rebranded as the Distro front door until the build-plane convergence retired it; one web UI (Genie) serves the ecosystem now. License retained in-tree.

OmniRoute · MIT · consumed remotely

The AI routing gateway: one OpenAI-compatible /v1/* endpoint in front of hundreds of upstream providers, with fallback and token/cost accounting.

Control plane · ships today

Multi-tenant layer: accounts, per-user gateway keys, quota enforcement, spend tracking, admin console, audit log — consumed by the builder surface over a token-gated service API.

The seam

Every model call carries the user's own gateway key, and the control plane decides identity, quota and audit around it. Attributable, capped, revocable.

# one command: secrets + gateway discovery + control plane
$ ./scripts/bootstrap.sh
>> [gateway] OmniRoute discovered → http://10.10.2.1:20128
>> [control] plane ready       → http://127.0.0.1:20140/admin

$ docker compose up -d --build && make doctor
control plane healthy · service key wired

# point the builder surface (Genie) at it:
#   CONTROL_PLANE_INTERNAL_URL + CONTROL_INTERNAL_TOKEN

Live on the stack.

Wildcard TLS through Nginx Proxy Manager, identity via Cerulean Authentik. The OmniRoute gateway also publishes on the LAN (dashboard + API keys on port 20128). The bolt.diy front door is retired — the builder surface is Genie; what ships here is the control plane.

Control planecp.distro.innotel.us · accounts, keys, adminlive Admin consoleadmin.distro.innotel.us · operations and quotaslive

Roadmap.

v0.4.0 is shipped and verified on the live stack; the control-plane roadmap tracks what's next.

v0.4.0 "Console"

Unity operator console: overview with a 14-day spend trend and needs-attention queue, per-account drawers, command palette, CSV export, and the token-gated service API Genie consumes.

shipped

0.5 "Metering"

Billing hooks via Magnate subscriptions, if paid tiers come into scope.