The operating layer for businesses with doors.
StromaOS runs access, membership and money for gyms, pools, libraries and stays — with the door hardware in the same repo as the console that runs it.
The door
A reader that decides on its own.
An ESP32 with a card reader, a relay and a 12 volt lock, in a printed enclosure. It holds its own roster, so a tap is answered by the board — not by a round trip to a server.
Losing the server loses visibility,
not entry.
Four printed parts
The green LED is the node made real.
The mark's live node is a diffuser behind the panel seam. The same shape reports the same thing on the reader, in the console and in the member's hand.
Three ways in
A card, a phone, or the front desk.
RFID card
Read in the roster the board already holds. Works with the network down, and with the lanyard labelled for what it is.
BACKUP CREDENTIAL
Stroma Pass
A signed code the member holds to the reader. Property-scoped, single-use, and dead thirty seconds after it is drawn.
30 s · SINGLE USE
The front desk
Somebody let in by hand — outside hours, a forgotten card. It lands in the same log as every other entry, with the name of who did it.
MANUAL · LOGGED
The console
There is no sidebar.
Navigation is summoned over the work and closes the moment you jump — so a table keeps the whole viewport, and there is one set of coordinates to learn instead of two. ⌘K carries the same tree, for the people who drive this two hundred times a day.
The member app
The cell is a door opening.
An attendance record nobody can fake, because it can only be filled by physically turning up. Freeze days keep it humane — a streak that punishes a member for having a life is a streak worth breaking.
This year
118 visits · 26 weeks
new code in 21s
Single use · this property only
Why this panel is dark
It is the one inverted surface in the whole product, and not for taste: a dark surround roughly doubles a 2D imager's exposure margin on a white code under gym lighting. One panel on one screen — not a theme.
Three ways in, one log
The card is a credential and the phone is another. Whichever opened the door, the entry lands in the same stream — with the door, the method and the reason.
One login. Three surfaces.
Phone or email and a password. What the database says you are decides where you come out — and it is read back on every request, so revoking somebody takes effect now rather than whenever their cookie expires.