Smarter declares its LLM guardrails as YAML manifests. A Guardrail is a resource like any other, applied with the same apply command as an LLMClient or a Plugin, and attached to an LLMClient by name. This post describes what a…
Smarter‘s production environment runs in an Amazon VPC where no pod, node, database or cache has a public IP address, and where web traffic has exactly one way in, through a Network Load Balancer on ports 80 and 443, in…
Smarter’s nightly MariaDB backup runs as a Kubernetes CronJob that dumps the database with a read-only account, receives only the environment variables it needs, installs only the tools it needs and verifies them, checks that the dump is complete before…
Smarter‘s Proxy is a Django view, built on httpx, that forwards requests to OpenAI, Anthropic, Google Gemini or Azure OpenAI with the provider’s API key added on the way out, so the people and programs that call the model never…
Smarter’s Helm chart puts the platform’s whole environment, including Django’s SECRET_KEY, the database passwords, the AWS keys and every LLM provider’s API key, into one Kubernetes Secret, and every pod reads it with envFrom. No credential is written into the…
Smarter sends its plugins’ requests to the open web through safe_http, a small wrapper around Python’s requests library that refuses to contact anything but a public https address. This post describes the attack it exists for, server-side request forgery (SSRF),…
Smarter sends its email through Amazon SES, and Terraform gives every environment its own SES domain identity, DKIM records and a DMARC policy, along with an SMTP user that can do one thing: send. This post walks through that setup…
Smarter runs a Celery Beat task once a day that finds Amazon Route 53 A records whose chatbot no longer exists, and deletes them. This post is about that sweep, why dangling DNS records matter, why Smarter’s are less dangerous…
When Smarter deploys an LLM chatbot, it creates an Amazon Route 53 A record, a Kubernetes Ingress and a cert-manager TLS certificate for that chatbot’s hostname and nothing else. There is no wildcard DNS record behind the platform’s API domain,…
Smarter gets its TLS certificates from Let’s Encrypt through cert-manager, using the DNS-01 challenge against Amazon Route 53, with one cert-manager ClusterIssuer for each Route 53 zone it owns. This post explains that arrangement as it is built in smarter-infrastructure,…