Front it, scale it, see everything.

Route paths to a pool of backends: a compute workload, a server pool, or a private service.

The upstream response streams straight through with no intermediate copy and a capped per-connection read buffer (--read-buffer-bytes), so large responses stay memory-bounded and per-request overhead stays low.

Tunnel HTTP upgrades and WebSockets to an upstream, now including wss/https targets over a real TLS handshake (webpki roots, pinned to the posture-validated address), so a private graphql-ws service proxies through the edge.

Round-robin (default) or random across the backend pool.

Route each request to the nearest healthy backend by region (--lb nearest). Compute-backed pools auto-tag replicas by their node's region, so there's no manual map.

Passive ejection after consecutive failures, plus active path probing with a cooldown.

Retry a body-less request against another backend on a connect failure.

Resolve the pool from an A/AAAA record set instead of listing backends by hand.

Override the upstream Host header, strip a path prefix, and set per-route timeouts.

Filesystem blobs + an embedded SlateDB KV store. Nothing else to run.

Many stateless serving processes over one shared KV, kept coherent by a changelog; scales reads without consensus.

An openraft-replicated control plane: voters form quorum in one region, learners serve local reads elsewhere. In-process complete; live multi-host operation is the remaining seam.

Grow a cluster with a one-paste join ticket (cluster add → serve --cluster-join): no static peer map; ids derive from each node's mesh key.

On a cluster, message delivery, crons, blob watchers, and the async-function drain shard across nodes by a stable hash over Raft membership instead of funnelling through the leader; exactly-once preserved by compare-and-set claims.

The in-binary operator reconciles a BoatRampCluster CRD into a StatefulSet or Deployment + HPA, with GitOps Site and quorum-safe rolling upgrades.

A real libsql database per site: a file on one node, or a sqld namespace across the cluster.

The leader issues each cert once and commits it to the log; every node replicates and hot-swaps on renewal.

Rotate the cluster root key make-before-break: both anchors stay trusted during the overlap, so no node ever rejects a valid token, and no per-node edit.

Signed control-plane tokens verified offline with a public key; no per-request database lookup.

Roles map to rights (read / write / deploy / admin) per resource, via a replaceable Cedar policy.

Exchange an IdP JWT (Okta, Keycloak, Auth0, Entra ID) for a short-TTL boatramp token.

Keep the signing key in HashiCorp Vault, a PKCS#11 HSM, or AWS / GCP / Azure KMS. Each specific service has a live seam.

Attenuate a token (one site, read-only, shorter expiry) by signing a restrict-only block, no server round-trip.

A guest mints a fleet-signed, expiry-bound capability token that attenuates a bounded slice of its own authority (host-forced to its own project, TTL clamped to an operator ceiling) for share links, embeds, or agent-to-agent handoffs.

Bind a token to a holder key with token create --pop: a leaked token is inert without the separately-held key, and every request signs a fresh, short-lived proof.

Reach the control plane from the first second over raw-public-key TLS (--tls rpk), encrypted and pinned before any CA-signed certificate exists.

Basic auth, IP allow/deny, rate limiting, and a WAF stage, per site, applied before any content is read.

Treat a named HttpOnly session cookie as the application bearer when a request carries no Authorization header (so a browser app authenticates its GraphQL / handler calls without shipping a token to JS), CSRF-checked against an allowed-origins allowlist.

Operator-only security postures (multi-tenant / single-tenant / dev), and envelope-encrypted certificate keys.

A function reconfigures its own project from inside the sandbox (attach a domain, set an SMTP profile, edit site config, rotate a secret) via a deploy-time grant strictly weaker than an admin token: project-scoped, verb-scoped, write-only, rate-limited, and audited.

Seal operator secrets per project with the [secrets] envelope: boatramp secrets set/rotate/ls/rm, sealed server-side and never readable back. Handlers and functions reference them by scheme (boatramp:NAME from the store, env:NAME from the process env, gated to single-tenant), resolved at instantiation and never persisted in the manifest.

A handler's outbound wasi:http has its own SSRF gate: blocked to non-global addresses by default, relaxed to private/loopback upstreams only under a trusted posture (allow_guest_private_egress). A guest may still call its own front door (allow_guest_self_egress), re-entering the full serve pipeline behind visitor auth and a forge-proof depth cap.

Every file is a SHA-256 blob, stored once and streamed end-to-end, never held whole in memory.

Local disk, or any S3-compatible object store: AWS, Cloudflare R2, or MinIO.

Google Cloud Storage (--blobs gcs) and Azure Blob (--blobs azure), streaming, with change-notification pipelines (GCS→Pub/Sub, Azure→Event Grid) that drive blob triggers.

Clients upload large objects straight into a project's blob container over plain S3: mint a short-lived, scope-clamped credential (a browser-ready presigned PUT, or STS-style temp creds for bulk) and, on a cloud backend, broker a native credential so bytes go direct to AWS/GCS/Azure and never transit the node.

Move between blob backends with zero downtime: a read-fallback secondary serves misses while an offline, resumable copy (or a daemon-mediated drain over the control plane) fills the new store, then a provably-safe purge reclaims the old.

Embedded SlateDB (an LSM over disk / S3 / R2 / GCS), in-memory, or Cloudflare KV.

Hot metadata is fronted by an LRU cache, kept coherent across processes by the shared store.

Requests, response bytes, deployments, activations, and cert renewals at /api/metrics.

JSON access logs, plus guest stdout/stderr with live tailing, per site (logs --site) or per standalone function (logs --function).

Invocations, errors, consumer lag, and dead-letters; redrive or purge a stuck topic.

A full operator toolkit for the durable bus: inspect and redrive the dead-letter queue, peek queues with per-group lag, tune lease / attempts / backoff, pause and resume, durably replay, and set delayed / TTL / priority delivery and per-topic flow-control caps.

Liveness and a readiness probe that fails when the metadata backend is unreachable.

Snapshot each backend, and re-hash every stored blob to confirm it still matches its key.

A versioned registry of forward-only store migrations the engine walks by a monotonic schema version: online, idempotent, and resumable (copy-before-delete), by hand with migrate or automatically via serve --auto-migrate.

A crown-jewel write (a sealed secret, an RBAC change, a domain proof) is durable before it acks, and an ordinary restart self-heals: a safe torn write-ahead-log tail is quarantined and the store opens on its own, never dropping acked state. An unsafe shape fails loud into a recovery-mode listener with a one-command kv recover.

Prune orphaned deployments and blobs; change operational knobs fleet-wide with no restart.

Run migrations and queries against a managed database with boatramp sql exec / query (server-side over the sealed credential, which never reaches the client), and open a shell in a running workload with boatramp compute exec (posture-gated) for a pg_dump or a debug session.

Live X-ray and manual levers over the co-located compute plane: compute status (per-replica health, phase, IP), force a reconcile, restart a wedged replica, set-health, inspect IP and internal-DNS assignments, netdiag, and sql ping a managed database.