Multi tenant/ multi projects in Directus

[mlepoutre-projex]

Hello,

Anyone know the right way to build a Directus 9 stack for multi tenant?

Thank you

[benhaynes]

The right way? There are a LOT of ways to build it — think of Directus as a database within your stack.

https://docs.directus.io/concepts/projects/#multitenancy

[benhaynes]

No specific docs on this as of now... but we'll be generating more in time.

[gensmann]

@emilianovelasco @wyteco @mlepoutre-projex you could look into https://www.phusionpassenger.com for an Nginx/app server running multiple node projects on the same machine setup using simple Nginx conf files. Then creating a new Tennant could be as simple as a hook on add or update on a master Directus installation collection, which creates the Nginx config file and the correct Tennant directory. To reuse the code etc you could symlink a folder in the Tennant directory on the server. Same solution could be spread over multiple Nginx app servers and even be used to create HA installations with multiple servers using a loadbalancer in front.

If you're a not looking into 100's of tenants on each server www.cloudron.io and it's one click installation of Directus might be an option as well. This would take of backup, database (Postgres) creation etc and a new tenant (Directus app) can be added through the cloudron API, including domain and mail management.

[xu4wang]

We have a similar project using odoo, one master database managing a number of tenant database. The idea is:

• assign on uniq URL(subdomain) to each tenant. create(or clone) database for this tenant based on it's uniq subdomain.
• in the application(in our case, the directus API implementation), for each API request, check the endpoint URL, and calculate which database to use.

In the solution above, there is only one directus API instance needed.
So technically you can support a huge number of tenants in one machine.

[mattbisme]

In the solution above, there is only one directus API instance needed.

So technically you can support a huge number of tenants in one machine.

@xu4wang I don't think I quite get this. As @benhaynes said, Directus only supports one database right now. Do you mean "collections" instead of databases, in this context?

[xu4wang]

Yes. for current Directus implementation ( V9.6 as of today), it's not supported. One API instance can only connect to one database.

I meant by customize directus API server to support multiple databases connection.

[vencax]

The way of multitenancy implementation I am thinking about is to move all the API routes under one more folder that woud identify a tenant and use one schema per tenant on DB level. O course there are more places that need to be split onto more tenants (media, custom plugins, ...). I would say it is doable.
The key is to have only one instance for the all tenants to not to waste resources.
Your opinions?

[mattbisme]

Something like API routes is definitely preferable. To minimize overhead, you'd still need some way of identifying ownership at the table row level (otherwise you need separate tables for each tenant). It seems reasonable to do that through user_created.group.id or have a group_owner column.

Currently, I'm using permissions as a way of faking groups/organizations and it's… challenging. Every time a new table is added, I have to change the permissions for every role. If a group column could just be one of the preselected system columns, that would make life much easier. Along with having, let's say, directus_groups as a separate table from permissions. Then it's easier to have roles within groups.

[vencax]

Using only certain schema through request processing is isolation among tenant data guaranteed, IMHO.

[kdubrovnyi]

@benhaynes hello and thanks for amazing product!
We've been analysing Directus to adopt it in our company.
We weren't able to find a straightforward way to setup multiple projects/brands with shared schema but separate content using one Directus setup.
I was trying to navigate the link that you posted earlier in this discussing, but looks like the link leads nowhere.
Wondering if you would be able to point us into the right direction on this, since otherwise it's a showstopper for us in adoption of Directus.
Thank you.

[benhaynes]

Thanks!! One good option for what you described would be to have ONE Directus project with ONE shared schema, and then use ROLES & PERMISSIONS to delineate the brands. In essence you would create a role per brand (could be automated with the API) and then set custom permissions using the $CURRENT_ROLE dynamic variable.

This will let you set CRUD access so that a brand can only see/manage THIER data. The same can be done for individual roles.

I hope this helps!

[alexvdvalk]

Here is the updated link: https://docs.directus.io/getting-started/glossary.html#multitenancy

[alexvdvalk]

This video by @bryantgillespie explains how to setup multitenancy in your Directus project: https://youtu.be/ruzkqxDIG-Y

[ernst86913]

You can also create an "items.create" filter which checks (using schema) whether the collection has an "account" field... if yes, you automatically set the account value to the user.account value... this way you have a generic multi-tenancy approach for any collections you create... you just need to create an "account" field in those collections... on top you need to make sure for each collection that users can only access collections with their account... and that no one can touch the account field after creation....

ISSUES which you need to work around separately:

• Assigning activities to an account so account owners/users can see activities related to their account
• Same with Revisions
• Account specific Presets
• Account specific Folders
• Account specific Files

... especially the activities and revisions are a bit more tricky unfortunately because those hooks unfortunately don't contain the original accountability of the underlying transaction (already raised as a bug).

BTW - you can make things a bit more advanced by e.g. adding the account to the JWT token, or e.g. by allowing one user to be part of multiple accounts and enable switching between those....

[vtisnado]

Hi guys, what I been doing is to have one Ubuntu server with NodeJS, Nginx, Mysql (LEMP) and run a separate instance of Directus in different port and using Nginx as reverse proxy.

This way I only have to maintain one server because each Directus instance connects to their corresponding database.

Until here everything works fine, however, I want to migrate to the new Docker installation.

I found an interesting example here: #17005
but as far as I understand, that yaml will create a new MySQL/Redis instance every time a new 'docker compose up' command is executed so I think that works only for one instance.

Here is another example running separate yaml file with one command: #6941 but in this case the MySQL database appears to be installed in the host server.

So I see 2 cases here (there could be other options as well like the database on an external provider):

1. Running a separate docker per Directus instance that connects to another docker with MySQL.
2. Running a separate docker per Directus instance that connects to a MySQL installed in the root/host server.

I'm wondering which option could be the more optimal in terms of resources usage.

With the LEMP approach I ran up to 5-6 Directus instances in a 2GB Ubuntu VPS using like 80% of RAM.