OverviewQuickstartdbt CompatibilityThe Style Guideprofiles.ymlsources.ymlConfigurationSupported Databases

THE DVT HUB

PORT :46100 · STARTS WITH dvt serve · SETTINGS WRITES ANSWER LOOPBACK ONLY

Every DVT app on this machine, one door. The hub shows live tiles for the running apps (green dots, ports), the roadmap of what's coming — and DVT Settings, which makes it the control plane for this machine and this project. Every other app carries a ⌂ HUB button that self-hides when the hub isn't running: no dead chrome, ever.

Starting

dvt serve          # whole suite, opens the hub
dvt hub            # the hub alone
dvt kill -s hub    # stop it

DVT Settings — the five tabs

  • ACCOUNT — your email, tier and AI-Proxy subscription status from cached credentials (never a network call in the page path) — plus offline activation: paste a machine-bound key on an air-gapped server, it verifies locally against the signing key, binds to that hardware, enforces expiry. No internet involved, ever.
  • MACHINE — OS, processor, architecture, cores, RAM — shown with the sizing truth attached: federation compute runs HERE, in DuckDB, bounded by this machine. Size it like the warehouse it replaces for transformation runs.
  • CONNECTIONS — a full credential manager for profiles.yml with zero hand-written YAML — see below.
  • AI CREDENTIALS — Claude / Gemini / Codex keys, an Ollama host for local models, and AI-Proxy base URL + key. Stored per-user in ~/.dvt with 600 permissions, displayed masked, treated write-only. With AI-Proxy configured, the per-provider keys become unnecessary.
  • HOSTING — the full port map (46100–46109, live and planned) with each app's auth posture — the page your network admin actually wants. The same map ships on the enterprise page.

The connection manager, in one pass

+ ADD CONNECTIONopens a dropdown of every supported engine and bucket. Picking one renders that adapter's own pre-filled field set — hosts, ports and sensible defaults in place, secrets as write-only password fields, a folder picker on filesystem paths. CREATE lands it as an editable card; add the next, set the default target from the dropdown at the top, then SYNC SOURCES runs dvt sync in the background until it reports SYNCED.

  • scoped to this project's profile — other profiles in the same profiles.yml are never touched — the profile name and file path are shown at the top so there's no ambiguity.
  • a backup on every write — timestamped copies beside profiles.yml; output is structurally valid YAML for every profile in the file.
  • guardrails — duplicate connection names are rejected; deleting the default target is refused until another default is set; secrets never round-trip (a masked value means 'keep what's there').

Security posture

The hub binds 127.0.0.1 by default. Even when exposed with --host, every settings write — credentials, AI keys, activation — answers only on loopback. Reading a status never requires a network call; writing a secret never leaves the machine.

← The App SuiteThe Data Catalog →