Overview
Infrastructure rules and general engineering guidelines for building production-ready, consistent Enjab tools.
Infrastructure rules and general engineering guidelines, so every Enjab tool ships production-ready and consistent: security, deployment, pipelines, and more. We publish these incrementally; each one lands here and in the changelog.
Every standard published here is mandatory for every Enjab tool, a hard gate before production, not a suggestion. They are strict on purpose: they are what keeps a fleet of tools safe, reliable, and consistent to operate.
Security
PII protection: no raw emails on public pages (use the [at] / [dot] format), and more.
Deployment
Where and how tools are hosted and served: Vercel by default, Cloudflare-fronted with Cloudflare-handled HTTPS elsewhere.
Pipeline
Source control and CI/CD: repos in the Enjab GitHub org, Git-based auto-deploy on push.
Servers (VPS)
Supported Ubuntu LTS on Hetzner only, dual-stack, hardened with one command (key-only server user, fail2ban, ufw, Docker).
Databases
Always the Enjab Supabase (never personal, never self-hosted), RLS on by default, RAG on pgvector.
Storage
Object storage is king: Cloudflare R2 (Enjab account) preferred, or the VPS, never self-hosted.