PumpkinStarter — Rust + SvelteKit Starter

What's inside

Everything wired, nothing hand-rolled

A small, opinionated set of well-known libraries glued together so you can focus on your product instead of plumbing.

Rust + Axum 0.8

Strict three-layer modules (controller / service / repository), tower middleware stack, structured tracing, request IDs, graceful shutdown.

Svelte 5 + SvelteKit 2

Static-rendered admin shell with route groups, auth guard, shared sidebar, header, and toast layer — typed end-to-end.

bits-ui + Tailwind 3

Accessible primitives — Dialog, Popover, DropdownMenu, Select, Tabs, AlertDialog — themed dark with CSS variables and tailwind-variants.

ApexCharts dashboards

Bar + line area charts with smooth curves, gradient fills, and shared hover tooltips — auto-themed on light/dark switch.

Argon2id auth

Modern memory-hard password hashing, OS-randomness salts, and per-request admin role checks via typed extractors.

JWT + refresh rotation

HS256 access tokens (12h), 30-day refresh tokens rotated on every use, sessionStorage on the client, generic 401 on the wire.

Diesel + SQLite

Type-safe DSL queries, r2d2 connection pool, embedded migrations, idempotent admin seeding. Drop in Postgres by flipping a feature flag.

Locked-down headers

X-Frame-Options DENY, no-sniff, strict referrer + permissions policy, HSTS in prod, CSP via SvelteKit-computed sha256 hashes — strict, no unsafe-inline for scripts.

Single-port deploy

One axum process serves the JSON API at / and the compiled admin shell at /admin/*. Brotli + gzip compression layered on every text response.

Quickstart

From clone to running in two steps

Copy the env template, generate a fresh secret, and start the server. The admin UI builds and serves on the same port.

bash

# 1. Provision a strong secret (32+ bytes; refuses to boot otherwise)
$ cp .env.example .env.local
$ echo "SECRET=$(openssl rand -base64 48)" >> .env.local

# 2. Run the dev stack (axum + admin UI on :3099)
$ ./run.sh dev

# Admin UI:  http://localhost:3099/admin/
# API docs:  http://localhost:3099/spec
# Landing:   http://localhost:3099/  ← you are here

API

The shape, not the details

Auth + user management out of the box. Full schema, request / response examples, and try-it-now in Swagger.

POST /auth/login email + password → access + refresh tokens

POST /auth/refresh rotate the refresh token, issue a fresh access token

GET /users?page=1&limit=100 paginated user list (admin only)

POST /users create a user with role and Argon2id-hashed password

DELETE /users/:id delete a user and revoke their refresh tokens

Full reference

The opinionated
Rust + SvelteKit starter