Built by 
About this software
About Institution Management System with Drag and Drop Builder CMS for Schools, Madrasas, Colleges, Universities and Coaching
Shikkha OS is a Next.js 16 / TypeScript / PostgreSQL (Drizzle) multi-tenant platform in which every institution gets a generated public website, editable in a drag-and-drop Profile Studio, plus a role-aware admin dashboard. The README states 45 management modules (admissions, attendance, exams, fees, payroll, library, transport, hostel, hifz and more), 12 built-in roles and 31 permissions enforced in server actions. A platform console sits above all tenants for the operator, and a public tutor marketplace is included. The interface is bilingual (Bangla and English via next-intl). It deploys with Docker Compose, an Ubuntu VPS or Vercel + Neon, and ships with a schema of 85 tables, demo seed data and five test suites that need no database. The digest shows no native mobile app and no payment-gateway or SMS integration; the fees module is a record-keeping workspace.
Why Institution Management System with Drag and Drop Builder CMS for Schools, Madrasas, Colleges, Universities and Coaching
What makes it better
than the alternatives
- 01
Generated tenant websites
Each institution gets a public profile at <slug>.domain or /i/<slug>, edited in a Profile Studio that shares one renderer with the live page.
- 02
Granular RBAC
Permissions are bit positions with per-member grants and denies on top of 12 role defaults, checked on every server-side write.
- 03
Revocable sessions
Signed HS256 JWT cookies are re-checked against a sessions table each request, with login lockout after 8 failures and password change revoking other devices.
- 04
Bangla-first and phone-friendly
Full Bangla/English messages, and sign-in accepts a Bangladeshi phone number or email.
- 05
Operator console and onboarding
Super-admin console with institutions, users and audit log pages, first-run setup, invitation links, and Docker/VPS/Vercel deployment docs.
Public Website & Profile Studio
- Auto-generated institution profile
- Drag-and-drop section editor with live preview
- Public teachers list and teacher pages
- Public notices page
- Image upload and media route
Admissions
- Public online admission form per institution
- Admissions board for the admin pipeline
- Admission server actions and enrolment actions
Fees & Finance
- Fees workspace in the admin area
- Finance server actions
- Payroll and budget modules listed in the module registry and roles
People, Roles & Permissions
- Create members or issue invitation links
- 12 roles and 31 permissions
- Per-member permission grants and denials
- Teacher management with a teacher studio page
Academic & Campus Modules
- 45-module registry with per-institution toggles
- Generic CRUD workspaces driven by table and field definitions
- Attendance
- exams
- library
- transport
- hostel and hifz named in the docs
Tutor Marketplace
- Public tutor directory and tutor profile pages
- Booking form on each tutor page
- Tutor administration within institutions
Platform Console
- Institution management table
- User management table
- Audit log page
- Super-admin only access gate at the edge
Auth & Security
- Email or phone sign-in
- Password hashing and strength policy
- Login lockout and session pruning
- Account panel with logout everywhere else
- Security notes in
docs/SECURITY.md
Search & Localisation
- Global search page and search component
- Bangla and English message files
- Locale-aware routing
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| TypeScript (React) | — | — | Front-end | 49.3% |
| TypeScript | — | — | Front-end | 43.3% |
| SQL | — | — | Database | 5.2% |
| CSS | — | — | Styling | 2.1% |
| Shell | — | — | Scripts | 0.2% |
- Primary language
- TypeScript 5.9 on Node.js 22.12+
- Framework
- Next.js 16.4 (App Router, Server Actions) with React 19.2
- Database
- PostgreSQL 16+ (Neon or self-hosted) via Drizzle ORM 0.45
- Authentication
- Email or phone sign-in, HS256-signed session cookie, server-side session rows checked on every request, revocable per device; no OAuth or SSO in the code
- Licence
- Single-site
- Screens
- 30
- Database tables
- 85
- Supported languages
- Bangla and English (next-intl), left-to-right; no RTL support
- Browser support
- Modern evergreen browsers; no explicit browser matrix in the digest
| Minimum | Recommended | |
|---|---|---|
| CPU | 2 vCPU | 4 vCPU |
| RAM | 4 GB | 8 GB |
| OS | Node.js 22.12+ (Docker image node:22-bookworm-slim); PostgreSQL 16; Ubuntu VPS or Docker host | Node.js 22.12+ (Docker image node:22-bookworm-slim); PostgreSQL 16; Ubuntu VPS or Docker host |
| Est. monthly hosting | $25 | $25 |
```sh cp .env.example .env # set POSTGRES_PASSWORD and AUTH_SECRET (openssl rand -base64 48) docker compose up -d --build # open http://localhost:3000 ```
```sh cp .env.example .env # set DATABASE_URL, AUTH_SECRET, NEXT_PUBLIC_ROOT_DOMAIN npm ci npm run db:setup # push schema and seed demo data npm run build npm start ```
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (6 minor)
No real credentials found; shared demo password and a dev fallback signing secret ship in the package; solid guard architecture visible, but most endpoints and actions could not be verified; several risks flagged; orm-based access looks safe, but most db code was not visible and the schema and seed files raise concerns; mostly reproducible; build-time and entrypoint details are unverified or inconsistent. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
