The latest articles on DEV Community by Duc Vu (@dukevu98). https://dev.to/dukevu98 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4190724%2F3cb75332-c933-47e6-82f3-9c9412a3a91f.png https://dev.to/dukevu98 en Duc Vu Sat, 17 Oct 2026 16:30:23 +0000 https://dev.to/dukevu98/im-building-an-open-source-platform-for-your-database-api-auth-and-apps-432 https://dev.to/dukevu98/im-building-an-open-source-platform-for-your-database-api-auth-and-apps-432 <p>I'm Duc. Since May 2025 I've been building <a href="https://excalibase.io" rel="noopener noreferrer">Excalibase</a> on nights and weekends, next to my day job.</p> <p>It started as a GraphQL engine for Postgres, because I like SQL. It's now an open-source platform as a service: one place for the database, the API on top of it, auth, and the apps that use it.</p> <h2> What you get </h2> <p>When you create a project, you get:</p> <ul> <li> <strong>A database.</strong> Postgres, or MySQL from this week's release. Backups and point-in-time restore are built in.</li> <li> <strong>A GraphQL and REST API</strong> generated from your schema. Add a table and it's in the API.</li> <li> <strong>Permissions per row and per column</strong>, written per role. "Users can only read their own notes" is one rule, and it applies to GraphQL, REST and realtime alike.</li> <li> <strong>Auth</strong> for your app's own users.</li> <li> <strong>Realtime</strong> subscriptions and <strong>functions</strong>.</li> <li> <strong>App hosting</strong>: your containers run next to the database, so there's no network hop to a database in another region.</li> <li> <strong>An MCP server</strong>, so your AI coding tool can create tables, set permissions and deploy your app. It only gets your token's permissions, and secrets don't show up in the chat.</li> </ul> <h2> How the API works </h2> <p>A GraphQL query, nested relations and the permission rules all compile into <strong>one SQL statement</strong>. One request means one query to the database, whatever the nesting depth, and no N+1.</p> <p>The permission filter is part of that same SQL, so the database never returns a row the user isn't allowed to see, and the app never has to filter afterwards.</p> <h2> Run it anywhere </h2> <ul> <li> <strong>Hosted</strong>: free beta at <a href="https://excalibase.io" rel="noopener noreferrer">excalibase.io</a> </li> <li> <strong>One box</strong>: Docker or Podman on a single VPS, same features as the hosted version (<a href="https://excalibase.io/docs/self-hosting" rel="noopener noreferrer">self-hosting guide</a>)</li> <li> <strong>Kubernetes</strong>: what the hosted version runs on</li> </ul> <p>The engine is open source under Apache 2.0: <a href="https://github.com/excalibase/excalibase-graphql" rel="noopener noreferrer">github.com/excalibase/excalibase-graphql</a></p> <h2> What's next </h2> <p>Hosting for static frontends on Cloudflare's network is in testing now: React, Vue, Astro, anything that builds to files, with your own domain. After that I'm choosing between ClickHouse, Redis/Valkey and AI agent workflows. There's a <a href="https://x.com/dukevu2506/status/2111466154283954313" rel="noopener noreferrer">poll on X</a> if you want a say.</p> <p>I post what ships and what breaks every day on X as <a href="https://x.com/dukevu2506" rel="noopener noreferrer">@dukevu2506</a>.</p> <p>If you try it, tell me what's confusing or broken. I read every piece of feedback.</p> postgres opensource webdev showdev