Services
Beskid has separate services for guidance, identity, learning, packages, delivery, and repository graphs. Select a service task before you diagnose a public service status.
Orientation
Section titled “Orientation”Identify your service task. Check the public service status and record the page URL, time, and visible error.
Choose a service guide
Section titled “Choose a service guide”- Read Authentication before you diagnose sign-in or service pairing.
- Select Learn, pckg, Tracker, or Nexus.
- Use Health and monitoring if a service does not respond.
The root Auth README says that pckg and Nexus use the Auth hub. That claim conflicts with the pinned, service-owned contracts and is under reconciliation. This page follows the service-owned contracts: pckg uses a separate trusted forward-auth boundary, and Nexus uses Caddy with Authentik.
The diagram shows the public service and authentication topology.
flowchart LR accTitle: Public service and authentication topology accDescr: Readers use public services. Tracker and Learn connect to the Auth hub. pckg uses trusted forward-auth. Caddy and Authentik protect Nexus. U[User] --> W[Website] U --> L[Learn] U --> P[pckg] U --> T[Tracker] U --> N[Nexus] T --> A[Auth hub] L -. configured pairing .-> A P -. protected browser routes .-> F[Trusted forward-auth] N -. protected route .-> C[Caddy] C --> K[Authentik]
Diagram text
Section titled “Diagram text”| Service | Public function | Authentication relationship |
|---|---|---|
| Website | Provides public guidance and the Docs. | Public reading does not require sign-in. |
| Auth hub | Performs GitHub OAuth and issues paired-service handoffs. | Tracker and configured Learn sessions use this boundary. |
| Learn | Runs interactive learning checks. | Its deployment can use configured auth-hub pairing values. |
| pckg | Serves package metadata and package artifacts. | CLI publication uses registry bearer keys. Protected browser routes require a separate trusted forward-auth boundary. |
| Tracker | Publishes delivery status and bugs from its own data. | It uses the Auth hub for GitHub sign-in. |
| Nexus | Presents a repository graph and an MCP endpoint. | Caddy and Authentik form its pinned forward-auth boundary. |
Limits
Section titled “Limits”You can name the selected service boundary and its authentication boundary. You also know which service owns persistent state.
If the public route fails, check the documented health endpoint. Give the service operator the URL, time, release identity, and response status. Do not send a credential or private response body.