One bucket per entity, on the engine that fits it: a queue for each user, a stack for each post, a priority queue for each job list.

hoardDB is a distributed database: six store engines on a consistent hash ring, with TLS and authentication on from the first start.

Pre-1.0 hoardDB is pre-1.0. Expect breaking changes. Every claim on this site, with its source.

The five-minute path

Four steps, as the binary printed them.

Captured
2026-09-22T12:27:42Z
From commit
eefdc6bdbd5b826f80fb25adb730cfde2192e77c
Reported version
hoardDB-server version=devel commit= build_date= protocol=1
Platform
linux/amd64
Edited
root password, cluster token, node id — by literal value, nothing else
  1. STEP 1: build and start — no arguments, no configuration file

    $ go build -o hoardDB-server ./cmd/server
    $ go build -o hoardDB-cli    ./cmd/cli
    $ ./hoardDB-server
    {"time":"2026-09-22T12:27:42.417967069Z","level":"INFO","msg":"hoardDB server starting","node_id":"<this machine>","listen":"0.0.0.0:4433","version":"version=devel commit= build_date="}
    {"time":"2026-09-22T12:27:42.418093176Z","level":"INFO","msg":"cluster token generated (first start)","token":"<cluster token — yours will differ>","saved_to":"data/cluster.token"}
    
    === CLUSTER TOKEN (save this!) ===
    <cluster token — yours will differ>
    ================================
    
    {"time":"2026-09-22T12:27:42.419322795Z","level":"INFO","msg":"auth signing key ready","kid":"1621e541","source":"loaded from data/auth.token.key"}
    
    === ROOT CREDENTIALS (shown only on first start) ===
    export HOARDB_ROOT_USER=admin
    export HOARDB_ROOT_PASSWORD='<root password — yours will differ>'
    Saved to data/root.password at 0600. Set HOARDB_ROOT_PASSWORD to choose your own, or
    delete the file to generate a new one.
    =====================================================
    {"time":"2026-09-22T12:27:42.463911575Z","level":"INFO","msg":"root user seeded","username":"admin","roles":["root"]}
    {"time":"2026-09-22T12:27:42.46410818Z","level":"INFO","msg":"root user bootstrapped into users.json","username":"admin","path":"data/users.json"}
    {"time":"2026-09-22T12:27:42.464275813Z","level":"INFO","msg":"TCP driver listener listening","address":"[::]:7433","fingerprint":"SHA256:cf89eec1b9634587613c27753bef68668e56271a7ce58ad29d47e196856fc06e","node_id":"<this machine>","alpn":"hoarddb/1"}
    {"time":"2026-09-22T12:27:42.464298029Z","level":"INFO","msg":"internode TCP listener listening","address":"0.0.0.0:4434","alpn":"hoarddb/1"}
    {"time":"2026-09-22T12:27:42.464299891Z","level":"INFO","msg":"metrics server disabled"}
    
    $ stat -c '%a %n' data/root.password
    600 data/root.password
  2. STEP 2: connect — the CLI reads ./data/root.password written by step 1

    $ ./hoardDB-cli -address 127.0.0.1:7433 -insecure
  3. STEPS 3 AND 4: create a database and a bucket, then write and read

    (one session; the transcript follows)
    
    WARNING: TLS certificate verification is disabled (--insecure); the connection to 127.0.0.1:7433 cannot be trusted and may be intercepted. Use this only against a local development server.
    2026/09/22 12:27:42 WARN TLS certificate verification disabled by an explicit insecure trust policy host=127.0.0.1:7433 reason="--insecure flag"
    Authenticated as admin
    Connected to 127.0.0.1:7433
    hoardDB CLI devel
    Type 'help' for help, 'exit' to quit.
    
    OK  created database app
    Next: use app
    Then: create bucket <name> {type: hash | btree | fifo | lifo | heap | blob}   (hash is the default)
    Switched to database 'app'
    OK  created bucket app.users (type hash)
    Indexes: [Email]
    OK  id=01a0c916-1634-7b83-aa85-cf545d22ac3c
    Found 1 results:
    {"Email": "ada@example.com", "Name": "ada", "_id_": "01a0c916-1634-7b83-aa85-cf545d22ac3c"}
    1
    Goodbye.

hoardDB is not MongoDB wire-compatible and does not aim to be. HQL is inspired by MongoDB's syntax; it is a different language.

Evidence: cli/parser.go:ParseCommand

Six engines. Pick one per bucket.

Six store engines: hash, b-tree, FIFO, LIFO, heap and blob. The engine is chosen when the bucket is created.

An engine cannot be changed after the bucket is created, and indexes are declared at creation time.

Evidence: cli/store_types.go:storeTypes· cli/unsupported_features.go:errAlterBucket

Each engine is a different way to read: hash by key, b-tree in key order, FIFO oldest first, LIFO newest first, heap by priority, blob as bytes.

Evidence: cli/store_types.go:storeTypes· store/heap.go:PopItem

The unit is the small bucket: one per user, one per post, one per job list. The load is in how many buckets there are, not in how large any one of them is.

Each bucket opens its own storage instance, and how many buckets one node can hold has not been measured. No figure appears on this site until it has.

Evidence: AGENTS.md:The unit is the small bucket· server/service.go:createBucketLocked

Store types, in the documentation →

TLS and authentication on, from the first start

hoardDB-server starts with no arguments and no configuration file.

Evidence: config/config.go:DefaultConfig· TestNoArgumentStartPathInTempDir

On first start it generates a self-signed TLS keypair and serves over TLS.

The certificate is self-signed: a first client connection trusts it on first use and records its fingerprint. It is not a CA-issued certificate.

Evidence: transport/transport.go:LoadOrCreateKeys· transport/transport.go:GenerateEd25519Keys

Authentication is always required. There is no flag that turns it off.

The CLI's -insecure flag is a client-side TLS verification bypass. It is not a server authentication switch, and there is no server-side equivalent.

Evidence: server/auth.go:NewCredential· server/authz.go:authorize

A root credential is generated on the first start and written to ./data/root.password at mode 0600.

Evidence: server/authkey.go:LoadOrCreateRootPassword· proof/five-minute-path.out

One binary

The database is one binary. There is no sidecar and no separate indexer process.

The CLI is a second binary, and it is a client rather than a component of the database.

Evidence: Makefile:build-server· cmd/server/main.go:main

Everything that is built →

Free to self-host

Free to self-host, including commercially and in production.

Evidence: LICENSE:Additional Use Grant

Where to check

The documentation on this site is the documentation in the repository. There is no second copy.

Evidence: website/scripts/prepare-docs.sh:stage_page

Read the claims ledger What is planned