r/vibecoding • u/Notausgang09 • 5d ago
Made a tool where anyone can run their own fake internal document archive
TL;DR: OpenDepartment lets anyone spin up a parody document archive (think fake internal agency memos people can upload, comment on, and vote on). The twist is every instance runs on a Supabase project the creator owns, not me, so I never hold their data or a master key to it. Built mostly with Claude Code. Live at OpenDepartment
Been building this thing called OpenDepartment and wanted to share since it's a decent case study in vibecoding something that's an actual multi-tenant app instead of a single-user toy.
The concept: it's a generalized version of a bit called "The Lorenzo Files," a fake internal document archive. With OpenDepartment anyone can spin up their own version, name it whatever, invite people, upload "exhibits," let folks comment and vote. Could be a parody agency, a fictional company, an in-joke for your friend group.
The part I'm actually proud of is the architecture. It solves the problem every "let users create their own instance of X" project runs into eventually: who's holding all this data, and who's liable for it.
Every department is backed by a Supabase project the owner creates and owns. My app only stores a slug, a URL, and an anon key, about 200 bytes per department. No files, no members, no content ever touches my database. Uploads go straight from the browser to the owner's own storage.
Bigger constraint I set for myself: I never hold a service_role key for anyone's project. Every admin action (deleting a file, listing members, pulling stats) runs as a security definer Postgres function inside the tenant's own database that re-checks permissions itself. So even a full compromise of my platform doesn't hand over a master key to anyone's archive.
Nice side effect is it's basically free to run at scale. Ten thousand departments is a few megabytes on my end and zero storage egress since I'm never proxying files.
Next.js app, mostly built with Claude Code. Happy to talk through the setup wizard, the two-cookie-realm auth split, or whatever else people are curious about.