A self-hosted inventory management system built with Blazor Server on .NET 10. Designed for home and small-business use with enterprise-grade security, multi-database support, machine learning integration, and comprehensive backup capabilities.
- Products - Full CRUD with batch tracking, expiry dates, price history, barcode/QR scanning, and specification PDF attachments
- Categories - Hierarchical product categorization with ML-powered auto-suggestion
- Storage Locations - Organize products across warehouses, rooms, and named storage spots
- Stock Movements - Track all incoming/outgoing movements with audit trail
- Multi-Warehouse - Support for multiple warehouses with per-user access control
- Custom Blazor Server authentication (cookie-based with circuit tracking)
- API key authentication for REST endpoints
- Two-factor authentication (TOTP via Google Authenticator)
- WebAuthn / Passkey support for passwordless login
- Magic link and email OTP login options
- Trusted device management with browser fingerprinting (Thumbmarkjs)
- Pwned password checking (Have I Been Pwned API)
- IP-based access rules per user
- Session management with real-time monitoring and remote termination
- Tamper-proof audit logging with hash chain verification
- Rate limiting (custom middleware + ASP.NET Core built-in)
- Security headers middleware (CSP, HSTS, X-Frame-Options, etc.)
- VPN detection via configurable subnet matching
- Anomaly Detection - Identifies unusual user behavior patterns using Randomized PCA
- Security Risk Scoring - Assesses per-user risk levels based on behavioral features
- Category Prediction - Auto-categorizes products using SDCA text classification with keyword-based fallback (2500+ keywords across 33 categories)
- Dedicated Blazor dashboards for each ML feature
- Models persist across deployments (included in publish output)
See ML/README.md for setup details and usage examples.
- Automatic scheduled backups with configurable intervals
- 7 backup providers: Local, Network Share, Azure Blob Storage, AWS S3, Google Drive, OneDrive, Cloudflare R2
- Automatic backup cleanup with configurable retention
- Encryption key backup with separate schedule
- JSON-based backup/restore (no external database tools required)
- Full database restore from any backup
- In-app notification bell with real-time updates
- Email notifications (SMTP with template support)
- Microsoft Teams webhook integration
- Configurable notification channels per alert type (low stock, expiry, security, system, weekly reports, password reset)
- Security alert system (burst attacks, brute force, DDoS, slow-rate detection)
- Interactive dashboard with ApexCharts
- Application insights (page views, API requests, performance metrics)
- Audit log dashboard with tamper-proof verification
- GDPR cleanup dashboard with automated data retention
- Weekly PDF reports (QuestPDF)
- Export to Excel (ClosedXML) and CSV
- Data import with validation
- Gamification system (user achievements and stats)
- Team presence indicators (online/away/busy)
- Ollama AI assistant integration (local LLM support)
- GeoLocation via MaxMind GeoIP2 (see GeoData/README.md)
- Cloudflare integration (bot protection, DDoS mitigation, geo-blocking, analytics)
- Progressive Web App (PWA) with service worker
- Responsive design with mobile support (touch gestures, camera scanning)
- Configurable privacy policy (GDPR-compliant, German law focus)
- Dark/light theme support
- Keyboard shortcuts
- Drag-and-drop interactions
| Layer | Technology |
|---|---|
| Framework | .NET 10, C# 14, Blazor Server (Interactive SSR) |
| Database | PostgreSQL (primary), MySQL, SQLite (portable fallback) |
| ORM | Entity Framework Core 10 with IDbContextFactory |
| ML | ML.NET 5.0 (anomaly detection, classification, vision) |
| Charts | Blazor-ApexCharts |
| QuestPDF | |
| Excel | ClosedXML |
| Barcode/QR | ZXing.Net, QRCoder |
| Image Processing | SixLabors.ImageSharp, SkiaSharp |
| Cloud Storage | Azure.Storage.Blobs, AWSSDK.S3, Google.Apis.Drive.v3, Microsoft.Graph (OneDrive) |
| Caching | In-memory (default), Redis (optional via StackExchange.Redis) |
| Authentication | Custom Blazor + API key schemes, WebAuthn, TOTP (Otp.NET, GoogleAuthenticator) |
| Fingerprinting | Soenneker.Blazor.Thumbmarkjs |
| GeoIP | MaxMind.GeoIP2 |
| API Docs | Microsoft.AspNetCore.OpenApi + Scalar |
| Hosting | Kestrel, IIS, Windows Service |
- .NET 10 SDK
- A supported database:
- PostgreSQL 14+ (recommended)
- MySQL 8.0+
- SQLite (no installation required, default fallback)
- Optional: MaxMind GeoLite2 database for IP geolocation
- Optional: Ollama for local AI assistant
git clone https://github.com/lukislp/Lagersystem.git
cd LagersystemCopy the example configuration and adjust settings:
cp LagersystemLVHome/appsettings.Example.json LagersystemLVHome/appsettings.jsonEdit appsettings.json and set your database connection string. By default, the application falls back to SQLite if no connection string is configured.
cd LagersystemLVHome
dotnet runNavigate to https://localhost:7239. On first launch, the setup wizard creates the database tables and prompts for the initial SuperAdmin account.
For IP-based geolocation features (session info, security dashboards):
- Create a free account at MaxMind
- Download
GeoLite2-City.mmdb - Place it in
LagersystemLVHome/GeoData/
See GeoData/README.md for detailed instructions.
Configure the provider in appsettings.json under DatabaseSettings:
PostgreSQL (recommended):
{
"DatabaseSettings": {
"Provider": "PostgreSQL",
"ConnectionString": "Host=localhost;Database=Lagersystem;Username=postgres;Password=PLACEHOLDER;"
}
}MySQL:
Known issue: currently broken on .NET 10 - Pomelo.EntityFrameworkCore.MySql has no stable release for EF Core 10 yet (latest is
9.0.0, targeting EF Core 9), which crashes the app at startup with aMissingMethodException. Use PostgreSQL or SQLite until Pomelo ships a compatible version.
{
"DatabaseSettings": {
"Provider": "MySQL",
"ConnectionString": "Server=localhost;Database=Lagersystem;User=root;Password=PLACEHOLDER;"
}
}SQLite (no server required):
{
"DatabaseSettings": {
"Provider": "SQLite",
"ConnectionString": "Data Source=inventory.db"
}
}Tables are created automatically on first run via EnsureCreatedAsync().
| Role | Permissions |
|---|---|
| SuperAdmin | Full system access: warehouse management, user administration, ML training, security monitoring, system settings |
| Admin | Full access within assigned warehouse: users, products, storage, audit logs |
| Manager | Product management, stock movements, batch tracking, reports (read), notifications |
| User | View products, book stock movements, scanner access, receive notifications |
The application exposes a REST API at /api/* endpoints, secured with API key authentication. API keys are managed per user in the profile settings.
Authentication: Include X-API-Key: <your-key> in request headers.
Available endpoints:
| Resource | Endpoints |
|---|---|
| Products | GET/POST /api/products, GET/PUT/DELETE /api/products/{id}, GET /api/products/barcode/{barcode} |
| Categories | GET/POST /api/categories, GET/PUT/DELETE /api/categories/{id} |
| Storage Locations | GET/POST /api/storage-locations, GET/PUT /api/storage-locations/{id} |
| Movements | GET/POST /api/movements |
| Batches | GET/POST /api/batches, GET /api/batches/expiring |
| Dashboard | GET /api/dashboard |
| Analytics | GET /api/analytics/stats, GET /api/analytics/trends |
| Sensors | GET /api/sensors/all, GET /api/sensors/low-stock, GET /api/sensors/expiring |
| Warehouses | GET/POST /api/warehouses, GET/PUT/DELETE /api/warehouses/{id} |
| Rooms | GET/POST /api/rooms, GET/PUT/DELETE /api/rooms/{id} |
| Alerts | GET /api/alerts |
| Notifications | GET /api/notifications |
| Audit Logs | GET /api/audit-logs |
| Search | GET /api/search |
| Users | GET /api/users (Admin) |
In development mode, interactive API documentation is available at /scalar/v1 (powered by Scalar).
LagersystemLVHome/ Web/UI project (Blazor Server host)
API/ REST API controllers, DTOs, and mappers
Authentication/ API key authentication handler
Components/
Layout/ MainLayout
Pages/
Admin/ Admin dashboards
Auth/ Login, register, password reset
Backup/ Backup management, database restore
Inventory/ Products, categories, storage, movements
Reports/ Insights, audit, GDPR, export/import
Security/ Security center, sessions, rate limiting
Settings/ User profile, app settings, notifications
Shared/ Reusable Blazor components
Configuration/ Strongly-typed settings classes
Controllers/ MVC controllers
GeoData/ MaxMind GeoIP database (not in repo)
Middleware/ Security headers, rate limiting, Cloudflare, session validation
wwwroot/ Static files (CSS, JS, PWA manifest)
Pass/ Encrypted database password (not in repo)
keys/ Data protection keys (not in repo)
LagersystemLVHome.Domain/ Entities and shared domain types
Models/ Entity Framework entity classes
LagersystemLVHome.Data/ Data access layer
Repositories/ Repository pattern implementations
InventoryDbContext.cs EF Core database context
LagersystemLVHome.Application/ Business logic and services
Services/
Auth/ Authentication, authorization, 2FA, WebAuthn
Backup/ Backup/restore, key backup, provider configs
BackupProviders/ Cloud backup provider implementations
Cache/ Memory and Redis caching
Database/ Database provider, health checks
Integration/ Cloudflare, GeoIP, Ollama, Teams presence
Inventory/ Products, categories, storage, pricing, barcode
Notification/ Email, Teams, in-app notifications
Reporting/ PDF reports, Excel export, insights, dashboard
Security/ Audit, GDPR, encryption, rate limiting, alerts
Session/ Session management, monitoring, trusted devices
UI/ Camera, toast, keyboard shortcuts, gamification
Utilities/ Helper classes and converters
LagersystemLVHome.Infrastructure/ Cross-cutting infrastructure
Data/ Circuit handlers for Blazor Server
HostedServices/ Background services (backup, cleanup, monitoring)
ML/
Components/ ML-specific Blazor dashboards
Keywords/ Category keyword definitions (33 categories)
Models/ ML data models
Services/ ML.NET service implementations
Data/ Trained ML model files
Services/ Additional infrastructure services (reporting, etc.)
All settings are documented in appsettings.Example.json. Key sections:
| Section | Purpose |
|---|---|
DatabaseSettings |
Database provider and connection string |
CacheSettings |
Memory/Redis cache configuration |
DashboardSettings |
Dashboard refresh intervals and defaults |
EmailSettings |
SMTP server for email notifications |
TeamsSettings |
Microsoft Teams webhook integration |
NotificationChannels |
Per-alert-type notification routing |
GdprSettings |
Automated data retention and cleanup schedules |
PerformanceSettings |
Response compression, output caching, pagination |
UISettings |
Drag-and-drop, keyboard shortcuts, toast duration |
ApiSettings |
OpenAPI toggle, API key requirement |
RateLimitSettings |
Rate limiting per role with endpoint overrides |
OllamaSettings |
Local LLM connection for AI assistant |
GeoIP |
MaxMind database path |
SecurityAlerts |
Burst, brute force, DDoS, slow-rate thresholds |
VpnDetection |
VPN subnet patterns |
CloudflareSettings |
Cloudflare integration (bot, DDoS, geo, WAF) |
PrivacyPolicySettings |
GDPR privacy policy content |
WebAuthn |
Passkey relying party configuration |
Real secrets are never committed:
- Copy
appsettings.Example.jsontoappsettings.Development.json(gitignored). - Leave
Password=PLACEHOLDERin the connection string. The real password is stored AES-256 encrypted inPass/db.password.encand decrypted at startup bySecureConnectionStringProvider. - Run
.\setup-database-password.ps1once to seed the encryption key and the encrypted blob. - For production prefer environment variables or a secret store (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault) over plain JSON configuration files.
dotnet publish -c Release -r win-x64 --self-containedCopy the published output to your IIS site directory. A web.config is included for IIS hosting configuration.
The application supports UseWindowsService() out of the box:
dotnet publish -c Release -r win-x64 --self-contained
sc create LagerSystem binPath="C:\path\to\LagersystemLVHome.exe"
sc start LagerSystemCreate appsettings.Production.json for production-specific settings (HTTPS endpoints, external SMTP, Cloudflare, etc.). See appsettings.Example.json for all available options.
- Repository Pattern - Data access abstraction (
IProductRepository,ICategoryRepository, etc.) - Service Layer - Business logic encapsulation with interface-based DI
- Factory Pattern - Backup provider selection (
BackupProviderFactory), database provider configuration - DbContext Factory - Thread-safe database access for Blazor Server (
IDbContextFactory<InventoryDbContext>) - Circuit Handlers - Blazor Server lifecycle management for sessions and authentication
- Hosted Services - Background tasks (backup scheduling, GDPR cleanup, session cleanup, security monitoring, weekly reports)
https://github.com/lukislp/Lagersystem
AGPL-3.0 - see LICENSE for details.