AbiData

A self-hosted data workspace: datasheets, queries, forms, reports, Lua scripts and jobs, in one Go binary.

Website · Documentation · Quick start · Releases

AbiData is an open-source database application platform for teams, in the spirit of Microsoft Access, built for the web. You design tables, queries, forms, reports and scripts in the browser, and the people you invite use them from a laptop or a phone. Everything for one project lives in a workspace, which is a SQLite file by default or a schema in your PostgreSQL database.

It ships as one Go binary with the React web app embedded, or as a container image. You run it on your own server, and your data stays there.

What you can build

Datasheets	Typed fields, lookups, calculated columns, validation, record history with field-by-field merge of conflicting edits, keyboard-driven editing, and CSV, Excel or JSON import and export.
Queries	A visual designer for joins, criteria and totals, and a read-only SQL editor with parameters and execution limits.
Forms and reports	A canvas form designer with subforms and Lua event handlers. Banded reports with grouping and totals, with server-side PDF output.
Maps and files	Location and Area fields with maps, photo and file attachments, and GPS capture on phones.
Lua scripts and jobs	Sandboxed Lua 5.1 with memory and CPU limits, run from forms and reports or on a cron schedule, with an egress allowlist for outbound requests.
Public apps and blogs	Publish forms and reports behind an unguessable link with no accounts, and give every user a Markdown blog with an Atom feed.
Teams	Viewer, editor, builder and owner roles per workspace, direct and workspace messages, live updates, scoped API keys and signed backups.
Mobile and access	An installable PWA with touch-friendly record cards, a command palette, and light and dark themes. Aimed at WCAG 2.1 AA (ACCESSIBILITY.md).

Two sample workspaces, Northwind Traders and Biosecurity Watch, are created when the first administrator finishes setup with the setup token, so a new install has something to explore. See the guide and the biosecurity walkthrough.

Quick start

Docker Compose

git clone https://github.com/AbishYoung/AbiData.git
cd AbiData
scripts/docker-dev.sh      # a local instance on http://localhost:8080

Read the one-time setup token from the log, open http://localhost:8080 and create the administrator:

docker compose -p abidata-dev -f compose.yaml -f compose.dev.yaml logs abidata | grep setup_token

For a server with automatic HTTPS through Caddy:

export ABIDATA_PUBLIC_URL=https://abidata.example.com
export ABIDATA_SITE=abidata.example.com
export ABIDATA_BOOTSTRAP_ADMIN_EMAIL=you@example.com
scripts/docker-prod.sh

Binary

Building needs Go (the version in go.mod) and Node.js 24.

make build            # writes bin/abidata with the web app embedded
bin/abidata serve

Set the same ABIDATA_* variables and put a TLS-terminating proxy in front, one that does not buffer text/event-stream. Releases publish prebuilt binaries and container images on the releases page.

The installation guide covers secrets, volumes, first run and upgrades; every setting is in the configuration reference.

Choosing a database

	SQLite (default)	PostgreSQL
Setup	None. One file per workspace.	A PostgreSQL 17 or later server.
Isolation	Separate files	A schema and login role per workspace
Good for	Small and medium teams, single servers	Shared database infrastructure, existing backups and operations
Select with	nothing	ABIDATA_DB=postgres and ABIDATA_POSTGRES_URL_FILE

An install uses one backend and you choose it before the first start. To move later, stop the server and copy the install to the other backend. The source is only read, so you can go back:

abidata migrate-backend --to postgres --target-data-dir /var/lib/abidata-pg

See PostgreSQL for setup, roles and the move.

API

Every feature of the web app is served by a REST API described by OpenAPI 3.1. Workspace owners create scoped API keys (viewer, editor or builder):

export ABIDATA=https://abidata.example.com WS=<workspace id> KEY=<api key>
curl -sS -H "Authorization: Bearer $KEY" "$ABIDATA/api/v1/w/$WS/schema"

Reading and writing rows, idempotency keys and version checks are in the API guide.

How it works

flowchart LR
  B["Browser or phone (PWA)"] -->|HTTPS| P["Reverse proxy"]
  K["API clients"] --> P
  G["Public app and blog visitors"] --> P
  P --> S

  subgraph S["abidata (one Go binary)"]
    API["HTTP API and embedded web app"]
    SCH["Job scheduler"]
    LUA["Lua sandbox"]
    EG["Egress gateway"]
    BK["Backups"]
    API --> LUA
    SCH --> LUA
    LUA --> EG
    API --> BK
  end

  API --> ADM[("Admin store")]
  API --> W[("Workspaces: SQLite files or PostgreSQL schemas")]
  BK --> BD[("Signed backup archives")]
  EG -->|allowlisted hosts only| NET((Internet))

Loading

Each workspace has its own database, statement cache and catalog. The Go server uses Huma on Chi, and the web app uses React, TypeScript, Vite and Tailwind. Design decisions are recorded as ADRs.

Security

Passwords are hashed with Argon2id, sessions are protected against CSRF, user SQL and Lua run in sandboxes, scripts reach the network only through an egress allowlist, and backups are signed. The security guide has the threat model and a production checklist. To report a vulnerability, follow SECURITY.md; please do not open a public issue.

Versions and releases

AbiData follows Semantic Versioning. Every pull request bumps the patch version, and releases are cut on minor versions. See RELEASING.md, the SemVer policy and the changelog.

Documentation

The documentation is built into every install (press ?) and published at https://abishyoung.github.io/AbiData/docs/.

• Use it: Welcome, Tables, Queries, Forms, Reports, Scripts, Jobs, Public apps, Blogs, Keyboard shortcuts
• Run it: Install, Configuration, PostgreSQL, Security, Monitoring, Backup strategy, Upgrade
• Reference: Lua API, Errors, Expressions
• About the site: how it is built

Contributing

Bug reports, documentation fixes, accessibility findings and code are welcome.

• CONTRIBUTING.md: development setup, checks and conventions (make dev, make test-changed, make lint)
• CODE_OF_CONDUCT.md
• ACCESSIBILITY.md: our target, how we test, and how to report a barrier
• SECURITY.md: private vulnerability reports

License

AbiData is released under the MIT License. Copyright © 2026 AbishYoung.