Umbral Tenants

Turn one app into a multi-tenant SaaS without forking it per customer. Umbral Tenants routes each tenant to its own Postgres schema (or scopes them by a tenant column), resolves the active tenant from the request, and binds it to the caller through a membership check so nobody reads across the wall. Pick the isolation strategy that fits — a schema per tenant for hard separation, a shared table for density — and the framework handles the routing.

Install

cargo add umbral-tenants

Wire it up

Choose which apps are tenant-scoped, the isolation strategy, and how the tenant is identified.

use umbral::prelude::*;
use umbral_tenants::{TenantsPlugin, TenantStrategy};

let app = App::builder()
    .database("default", pool)
    .plugin(
        TenantsPlugin::new()
            .strategy(TenantStrategy::Schema)   // one DB, a schema per tenant
            .tenant_apps(["billing", "projects"])
            .tenant_header("X-Tenant"),
    )
    .build()?;

Target: hard isolation with a safety net

Run TenantStrategy::Schema for separation and layer umbral-rls underneath, so the database enforces the tenant boundary even if request routing has a bug.

What you get

• Schema-per-tenant or row-per-tenant (shared column) strategies
• Tenant resolved from the request (header or your own resolver)
• Membership binding so a caller can't read another tenant's data
• Choose which apps are tenant-scoped and which stay shared
• Pairs with umbral-rls for database-enforced defence in depth