Battle-tested infra. None of the lock-in.
Two services do the heavy lifting — Supabase and Bunny — and everything else is opt-in. Bring your own keys; the operator owns every account.
Required
The two services without which the product won't run.
Auth, Postgres, RLS, pgvector, Storage.
Encoding, HLS/MP4, token auth, CDN.
Webhook callbacks at /api/bunny/webhook for encoding status.
Optional
Plug in what you need. Skip what you don't.
Transactional email delivery.
Bot protection on signup and comments.
Request-level security: rate limit, bot detection, shield.
AI meta generation (Pro+).
Error tracking (env-toggle).
Built-in /api/vitals endpoint.
Health & ops endpoints
Probe-friendly endpoints for orchestrators, uptime monitors, and the fleet command.
- /api/healthLiveness probe
- /api/readyReadiness — includes DB + Bunny ping
- /api/versionRunning build version
- /api/verifyLicense verify (signed protocol-v1)
- /api/revalidateTrigger ISR revalidation
Setup steps for each integration live in the configure docs. Keys go in your .env — never the codebase.