Why every library gets its own copy of the system

Once it became clear that the idea of Katlog might be of interest beyond a single experiment, the first architectural question arose. How do you offer the system to other libraries in a way that is secure, cheap, and doesn’t require us to provide round-the-clock support?

Two paths

A shared platform. One system that hosts every library, each seeing only its own data. Most cloud services work this way. One update for everyone; easier to maintain.

Your own copy. Each library gets a separate installation with its own database. The librarian copies a template, creates their account on first launch and uploads the catalogue file.

Why we chose separate copies

The data is physically separated. On a shared platform, one mistake in a permission check could show one library’s readers another library’s requests. Separate copies simply don’t contain anyone else’s data.
Nothing to hack “in bulk”. An attack on one copy doesn’t open the door to all the others.
Almost free. A small library with thousands of records and dozens of requests a day needs only the most modest hosting.
The library stays in charge. The code and the data belong to it and can be downloaded and moved.

The priceUpdates have to be rolled out to each copy. A fix made on our side won’t reach colleagues by itself. That is manageable for ten libraries, not for a hundred.

A closed library, a closed system

A second decision of the same kind: Katlog is designed for closed libraries, so there is no self-registration. Logins and temporary passwords are issued by the librarian, and readers must sign a consent to the processing of their personal data. Without the consent flag, login is impossible.

No real readers take part in the experiment itself, and no reader data is used. All accounts in the screenshots are test accounts with fictitious names.

This is not just legal tidiness. Every registration form is a door anyone can knock on. No door, no problem.

Katlog librarian workspace: the “Readers” section with test accounts — Only the librarian creates and edits reader accounts; consent to data processing is recorded separately. The reader in the screenshot is a test account; the screenshot shows the Russian interface.

Keeping the option open

We are not closing off the shared-platform route. The database already includes the concept of a “library”, so that one day we could move to the second path without a rewrite. But starting with it while there are only a handful of users would mean building a skyscraper for three tenants.