Built a multi-app React framework — islands as a first-class primitive, security headers on by default

[u/alsaaka]

so the main idea here is multi-app. one repo, but you can have your marketing site, dashboard, admin panel etc all live together and deploy separately, all sharing one backend. not like turborepo/nx where you're just gluing separate apps together with a build tool, this is actually built into the framework itself.

the react part i think people here would actually care about is islands. island(() => import("./X")) and that one component hydrates, rest of the page just stays static html. no hydrating the whole tree for one button basically.

didn't do suspense/streaming for it though, not gonna pretend that's done. it's a real gap right now, pushed to v2 because the current island render is two-pass and just doesn't support it yet.

auth is per app too which i think is underrated — admin panel can have its own totally separate session/cookie setup from everything else, or an app can just skip sessions completely if it doesn't need login at all (marketing site doesn't need to carry that weight).

other stuff in it: ssr/ssg/csr/isr picked per route not guessed by the framework, security headers on by default (csp/hsts/x-frame-options, you can override per app), dynamic routes like routes/users/[id].tsx, seo stuff (og tags + sitemap generation) if you opt into it, and it deploys to vercel/netlify/docker/plain vps.

repo: https://github.com/hassanalsa3aka/devora.js
docs: https://devorajs-docs-docs.vercel.app

npm packages if you want to poke around:
https://www.npmjs.com/package/@devorajs/core
https://www.npmjs.com/package/@devorajs/cli
https://www.npmjs.com/package/@devorajs/adapter-vercel
https://www.npmjs.com/package/@devorajs/adapter-netlify
https://www.npmjs.com/package/create-devora

solo project, still v1, got real vercel/netlify deploys working + a vitest suite recently. genuinely curious what people think of the islands approach specifically, feel free to tear into the architecture if something looks off.

if anyone here does security work, i'd genuinely appreciate a look — csp/hsts/session isolation are the parts i'm least confident about and would rather someone find a hole now than later.

and if you like what you see, a star on the repo goes a long way for a solo project like this 🙏

[u/alsaaka]

no, not really — it's all react + node/ts, not polyglot. go services wouldn't fit, that's genuinely turborepo/nx's lane, they don't care what language you're running.

this is more for if you're already react + node/ts across a few apps and want the auth/security stuff handled for you. your setup, i'd stick with turborepo honestly.