The short answer is, “it’s always about money”. Smarter runs MariaDB for relational persistence, and Traefik for its reverse proxy service (aka the ‘web server’). Both work great, but you nonetheless would not be faulted for asking, “why cut against…
Smarter‘s Proxy is a Django view, built on httpx, that forwards requests to OpenAI, Anthropic, Google Gemini or Azure OpenAI with the provider’s API key added on the way out, so the people and programs that call the model never…
Smarter runs on Docker everywhere and on Kubernetes in production. Those two choices, recorded as ADR-002 and ADR-003, are what let one Docker image go from a developer’s laptop to a large organization’s production Kubernetes cluster without a rewrite, a…
Smarter’s Helm chart puts the platform’s whole environment, including Django’s SECRET_KEY, the database passwords, the AWS keys and every LLM provider’s API key, into one Kubernetes Secret, and every pod reads it with envFrom. No credential is written into the…
Smarter sends its plugins’ requests to the open web through safe_http, a small wrapper around Python’s requests library that refuses to contact anything but a public https address. This post describes the attack it exists for, server-side request forgery (SSRF),…
Smarter sends its email through Amazon SES, and Terraform gives every environment its own SES domain identity, DKIM records and a DMARC policy, along with an SMTP user that can do one thing: send. This post walks through that setup…
Smarter runs a Celery Beat task once a day that finds Amazon Route 53 A records whose chatbot no longer exists, and deletes them. This post is about that sweep, why dangling DNS records matter, why Smarter’s are less dangerous…
When Smarter deploys an LLM chatbot, it creates an Amazon Route 53 A record, a Kubernetes Ingress and a cert-manager TLS certificate for that chatbot’s hostname and nothing else. There is no wildcard DNS record behind the platform’s API domain,…
Smarter gets its TLS certificates from Let’s Encrypt through cert-manager, using the DNS-01 challenge against Amazon Route 53, with one cert-manager ClusterIssuer for each Route 53 zone it owns. This post explains that arrangement as it is built in smarter-infrastructure,…
Smarter lets an account serve its chatbots from a domain of its own, and it uses Amazon Route 53 and AWS Certificate Manager (ACM) to check that the account really controls that domain before anything is served on it. This…