What the ecosystem is¶
In one sentence¶
The Gerege ecosystem is one ecosystem of digital services grounded in a national
eID/PKI core, wired together by an SSO layer, and branched out of a single shared
template — built along two mirrored lines in parallel: government (*.dgov.mn)
and private sector (*.gerege.mn).
Why build it this way?¶
Traditionally each digital service is stood up on its own: its own login, its own authorisation model, its own security posture. The result:
- citizens sign in differently to every service,
- every organisation reinvents PKI,
- the security bar differs from service to service,
- one fix has to be applied repeatedly across many systems.
The Gerege ecosystem starts from the opposite end: identity, security, AI and the service scaffolding are solved once, and each vertical adds only its own value on top. Developers write their product, not their infrastructure.
This is Gerege Systems LLC's mission — "deliver public and private sector services to citizens the easy way" — expressed as code. One foundation carries both a government agency's service and a private-sector product in banking, insurance, fintech, health or education, at the same level of assurance and security.
Three load-bearing ideas¶
1. Identity is infrastructure, not every app's problem¶
Authentication, signing and certificates are solved once, in eID Mongolia. Applications store no passwords and write no PKI code — they simply connect as a relying party (RP).
- The signing private key never exists in full anywhere — 2-of-2 threshold ECDSA (one share on the phone, one on the server).
- Every citizen holds two certificates: Authentication (PIN1, sign-in) and Signing (PIN2, legally binding signature).
2. SSO is the only path from identity to applications¶
Applications never reach eID directly. The SSO layer sits in between — a standard OAuth2/OIDC provider. It:
- centralises sign-in and gives every RP the same flow,
- acts as an eID proxy: permitted eID services are relayed only to registered applications,
- keeps credentials in one place, so two systems can never drift apart.
3. The platform is itself a product¶
The Template Platform is not sample code — it is a production-ready foundation: Clean Architecture Go backend + Next.js BFF frontend + Gemini AI pipeline, security-hardened and tested. Ring, Khurdan, Wallet and the Developer Portal all branch from it.
Two mirrored lines¶
| Layer | Government (dgov.mn) |
Private sector (gerege.mn) |
|---|---|---|
| Identity | eID Mongolia (shared) | eID Mongolia (shared) |
| SSO | sso.dgov.mn |
sso.gerege.mn |
| Template | template.dgov.mn |
open.gerege.mn |
| Developer | developer.dgov.mn |
developer.gerege.mn |
| Verticals | Ring · Khurdan | Gerege Platform · Wallet |
Both lines share one code lineage — the same architecture, the same conventions, the same security baseline. They differ only in branding, legal context and the scope of their integrations.
Why two lines?
Government and private-sector services differ in legal requirements, data governance and audit regime. Serving both from one deployment would blur those boundaries. So: one codebase, two deployments.
Four major shifts¶
1. Fragmentation → consolidation. Separate eID repositories were merged into a
single eid-platform-mn monorepo, one branch, one brand; app variants serve multiple
brands.
2. Removing third-party dependence. Ory Hydra was dropped from every SSO project and the required behaviour rewritten as first-party Go code; the separate Hydra database was merged into the main one. The broader direction is fewer external dependencies.
3. Platform → ecosystem. The template became a product in its own right, with real agency platforms above it and the X-Road data-exchange layer below.
4. Fork → upstream (2026-08). Gerege Nexus arrived at layer 3 — a new foundation built as a modular monolith with an app store. Where a new product used to mean a fork of the template, it now means writing a module or, for a brand, forking the upstream and refreshing by merging from it. The first two forks are Gerege SSO and Eduge.mn. The transition is under way, so the 1st-generation platforms remain in production.