An admin panel for your existing Postgres

One Rust binary. No framework, no ORM, no Node runtime. Point cartapel at your database and get a Django-admin-quality panel — every customization is HCL you version like code.

Try the live demo Get started Star on GitHub

no login needed — click around, it resets daily

cartapel list view: introspected table with filters, saved views and inline editing

Config as code

A table appears when you give it a file. Columns, primary keys and foreign keys are introspected; an empty file already renders lists with search, filters, sorting and sane widgets. Everything else is a few honest lines of HCL — reviewed in a pull request, not clicked in a GUI. 

# screens/sales/orders/screen.hcl
list {
  columns = ["id", "customer_id", "status", "total"]
  filters = ["status"]
  sort    = "-placed_at"
}

field "status" {
  widget = "badge"
  params = { colors = { paid = "green", refunded = "red" } }
}

action "refund" {
  label   = "Refund"
  kind    = "update"
  set     = { status = "refunded" }
  confirm = "Refund {count} orders?"
}

Roles, audit, revert

Per-table, per-column and row-level permissions in versioned config — with inheritance and multi-role union. Every write lands in an audit log with before/after diffs and one-click revert.

SQL dashboards

Stat tiles, charts and tables straight from SQL, with template variables and a shareable URL. All read-only, all timeout-guarded.

Zero-config relations

Introspected foreign keys become links and inline child tables on every detail page. No configuration required at all.

Custom pages

Drop a .tsx module next to your config — transpiled in the browser with the sx SDK in scope. No build step, no npm.

Yours to theme

Presets (including a faithful Django look), your accent color, per-mode design tokens and per-locale labels — one HCL block, hot-reloaded.

Hardened by default

Bound parameters everywhere, secret-shaped columns auto-masked (admins included), signed sessions, read-only dashboard transactions.

cartapel dashboard: SQL stat tiles, charts and a window selector

Running in one minute

docker run -p 8686:8686 \
  -e CARTAPEL_DB=postgres://user:pass@host/db \
  -e CARTAPEL_SECRET_KEY=$(openssl rand -hex 32) \
  -e [email protected] -e CARTAPEL_ADMIN_PASSWORD=change-me \
  ghcr.io/de-rus/cartapel serve --config /data/admin

Or skip the terminal: one-click deploy to Render — it asks for your database URL and drops you into the setup wizard.

Questions

Is cartapel free?
Yes. cartapel is MIT-licensed and free — the whole thing, including roles, audit log and dashboards. There is no paid tier and no per-user pricing.
Does it write to my database?
Never on its own. Your Postgres is only written to when a panel user edits a row, runs a bulk action, or imports data. All of cartapel’s own state — users, sessions, audit log — lives in a separate SQLite directory.
Can I use it with an existing production database?
That is the whole point: cartapel introspects your live schema, so there is no model layer to generate or keep in sync. Tables are an allowlist — nothing is exposed until you register it — every value is a bound parameter, and dashboard SQL runs in read-only transactions with a statement timeout.
How is it different from Django admin or Retool?
Django admin needs a Django app and ORM models kept in sync with your schema; cartapel reads the schema directly and runs beside any stack. Retool is a broader GUI app builder with per-user pricing; cartapel is a free single binary configured as HCL you review in pull requests.
Does it need Node?
No. The frontend is compiled once and embedded in the binary, so at runtime the only dependency is your Postgres. Even custom .tsx pages are transpiled in the browser — no build step, no npm.
How do I deploy it?
Run the Docker image or the bare binary with a Postgres URL and a secret key, and put the small SQLite data directory on durable storage. There is also a one-click deploy to Render that drops you into the setup wizard.

Weighing alternatives? Read the honest comparison with Django admin, Retool, Metabase & friends.