What is Opaeron?

#Opaeron by the numbers

These figures were counted from the repository.

#The stack

• Frontend: React 19 and Vite 7, React Router 7, Tailwind CSS v4, Recharts and D3 for analytics, dnd-kit for drag-ordered boards.
• Backend: FastAPI with Pydantic v2 and a hand-written psycopg3 query builder instead of an ORM.
• Data: self-hosted PostgreSQL 16 with pgvector. The move off Supabase is described in Supabase to Self-Hosted Postgres.
• Jobs: Celery workers and Celery beat on Redis. See Celery and Redis for LLM Jobs.
• AI: a gateway on OpenRouter that routes each task to a model and falls back across providers. See LLM Model Routing.

#How the transcript pipeline works

1. The transcript is split into model-safe chunks.
2. Each chunk goes through extraction, producing candidate action items.
3. Retrieval-augmented context injects account members and prior tasks, so the model knows who a first name refers to before it assigns anything.
4. A deduplication pass removes items that appear in more than one chunk.
5. A rules engine suggests owners from keyword-to-person mappings.
6. A second asynchronous pass writes the narrative summary on a Celery worker.
7. A global text guard rewrites formulaic AI phrasing and strips em dashes from generated responses before anyone sees them.

The full pipeline is written up in Meeting Transcript to Action Items: an LLM Pipeline.

#Deployment

A multi-stage Dockerfile builds the React bundle and FastAPI serves it from the runtime image, so there is one deployable unit. Docker Compose runs the app, a Celery worker, Celery beat, Redis and Postgres behind nginx. The beat schedule covers deadline reminders every 15 minutes, nightly recurrence regeneration, a nightly database backup, a daily ads sync and weekly telemetry pruning. GitHub Actions deploys on push to the main branch.

#Client portal and security

The public client report site runs on its own subdomain with a separate session system, so a client can only ever see their own account.

• Sign-in uses a long per-account access code plus an email one-time code, exchanged for an opaque SHA-256 session token instead of a JWT.
• The session cookie is HttpOnly with no Domain attribute, so it cannot be sent to the internal application host.
• The account identity always comes from the server-side session row, never from a URL or request parameter.
• Every endpoint fails closed: if an account's report is disabled internally, authentication itself rejects.

The internal application has no Row Level Security, so authorization is enforced in application code on every route, and each mutating action is written to an audit log.