A local-first marketing operations control center for teams running human and agent workflows.
Marketing Dashboard brings CRM, outreach, content planning, analytics, approvals, automation schedules, and agent activity into one self-hosted interface. It runs on Next.js and SQLite, works without required hosted infrastructure, and can connect to OpenClaw and external marketing services when you choose.
Project status: alpha. The working surface is broad, but APIs, schemas, and configuration may change between releases.
What it controls
| Area |
Current surface |
| CRM |
Leads, sources, pipeline stages, lead quality, and record details |
| Outreach |
Sequences, suppression, pausing, audits, and engagement |
| Content |
Calendar, content items, performance, and approval queues |
| Analytics |
KPI views plus optional Plausible, GA4, X, and LinkedIn connectors |
| Agents |
OpenClaw instance discovery, squads, workspaces, sessions, and communications |
| Automations |
Cron jobs, templates, approvals, activity, and deployment status |
The dashboard is operator-led. Approval, pause, writeback, and host-access controls remain visible instead of being hidden behind autonomous execution.
Quick start
Requirements
- Node.js 20
- pnpm 10
- A local machine or private host that can persist SQLite state
Run locally
git clone https://github.com/builderz-labs/marketing-dashboard.git
cd marketing-dashboard
corepack enable
pnpm install --frozen-lockfile
pnpm env:bootstrap
pnpm dev
Open http://localhost:3000.
The first login is seeded from AUTH_USER and AUTH_PASS when the users table is empty. Change the example credentials in .env.local before starting the application.
Local-first architecture
The application, authentication, and SQLite state run locally. Provider connectors are optional and receive credentials from server-side environment variables.
| Layer |
Implementation |
| Application |
Next.js 16 App Router, React 19, TypeScript |
| Interface |
Tailwind CSS 4, Recharts, Zustand |
| State |
SQLite through better-sqlite3 |
| Authentication |
Session cookie, API key, optional Google OAuth |
| Agent connection |
OpenClaw CLI and filesystem discovery |
| Deployment |
Local process, standalone build, or private HTTPS host |
Environment variables retain the HERMES_* prefix for backward compatibility with existing deployments. The public project name is Marketing Dashboard.
Configuration
Copy .env.example to .env.local through pnpm env:bootstrap, then replace all seed secrets.
Required
| Variable |
Purpose |
AUTH_USER |
Initial admin username |
AUTH_PASS |
Initial admin password, minimum 10 characters |
API_KEY |
API and webhook authentication |
AUTH_COOKIE_SECURE |
Set true on HTTPS deployments |
Runtime and host boundaries
| Variable |
Default |
Purpose |
HERMES_STATE_DIR |
./state |
Local SQLite and runtime state |
HERMES_OPENCLAW_HOME |
~/.openclaw |
Default OpenClaw home |
HERMES_HOST_LOCK |
local |
Restrict accepted hosts |
HERMES_ALLOW_POLICY_WRITE |
false |
Allow policy file changes |
HERMES_ALLOW_CRON_WRITE |
false |
Allow cron file changes |
HERMES_ALLOW_WORKSPACE_WRITE |
false |
Allow agent workspace changes |
Multi-instance discovery uses HERMES_OPENCLAW_INSTANCES, a JSON array documented in .env.example.
Optional integrations
- Google OAuth
- Plausible and Google Analytics 4
- Gmail and Mailchimp
- Sanity
- Helius
- X and LinkedIn
- 1Password runtime environment overlays
- Ollama model-health checks
Every integration is optional. Keep unused credentials unset.
Deployment safety
Start with a local read-only posture, verify each boundary, and enable writeback only for operations you intend to expose.
- Replace
AUTH_USER, AUTH_PASS, and API_KEY.
- Keep
HERMES_HOST_LOCK=local unless you have an explicit host allowlist.
- Use HTTPS and
AUTH_COOKIE_SECURE=true outside local development.
- Load production secrets from a secret manager or runtime environment.
- Leave all
HERMES_ALLOW_*_WRITE variables disabled until their write paths are required and reviewed.
- Return to read-only mode by disabling the writeback flags.
See SECURITY.md for private vulnerability reporting and supported-version policy.
Screenshots
Mission-control overview
CRM and operating surfaces
The screenshot filenames retain their original names for compatibility with existing links.
Development
pnpm lint
pnpm typecheck
pnpm test
pnpm build
pnpm test:e2e
bash ./scripts/template-audit.sh
The CI workflow runs the template audit, lint, typecheck, unit tests, production build, and Playwright tests.
Standalone deployment
pnpm build:standalone
pnpm start
Operational examples for systemd and 1Password live under ops/.
Template export
Before sharing or publishing a derived template:
bash ./scripts/template-audit.sh
bash ./scripts/template-export.sh ./export
The export excludes environment files, databases, build output, dependency directories, test artifacts, and runtime state.
Repository policy
Use GitHub Issues for reproducible bugs and scoped feature requests. Security reports must not be filed publicly.
Built by Builderz
Builderz builds agent infrastructure, trading systems, and Solana applications.
Maintained by Nyk. Sponsor ongoing open-source maintenance or follow @nykdotdev.
License
Licensed under the MIT License.
评论