Smarter runs on Docker everywhere and on Kubernetes in production. Those two choices, recorded as ADR-002 and ADR-003, are what let one Docker image go from a developer’s laptop to a large organization’s production Kubernetes cluster without a rewrite, a…
Smarter’s Helm chart puts the platform’s whole environment, including Django’s SECRET_KEY, the database passwords, the AWS keys and every LLM provider’s API key, into one Kubernetes Secret, and every pod reads it with envFrom. No credential is written into the…
Smarter sends its plugins’ requests to the open web through safe_http, a small wrapper around Python’s requests library that refuses to contact anything but a public https address. This post describes the attack it exists for, server-side request forgery (SSRF),…
Smarter sends its email through Amazon SES, and Terraform gives every environment its own SES domain identity, DKIM records and a DMARC policy, along with an SMTP user that can do one thing: send. This post walks through that setup…
Smarter runs a Celery Beat task once a day that finds Amazon Route 53 A records whose chatbot no longer exists, and deletes them. This post is about that sweep, why dangling DNS records matter, why Smarter’s are less dangerous…
When Smarter deploys an LLM chatbot, it creates an Amazon Route 53 A record, a Kubernetes Ingress and a cert-manager TLS certificate for that chatbot’s hostname and nothing else. There is no wildcard DNS record behind the platform’s API domain,…
Smarter gets its TLS certificates from Let’s Encrypt through cert-manager, using the DNS-01 challenge against Amazon Route 53, with one cert-manager ClusterIssuer for each Route 53 zone it owns. This post explains that arrangement as it is built in smarter-infrastructure,…
Smarter lets an account serve its chatbots from a domain of its own, and it uses Amazon Route 53 and AWS Certificate Manager (ACM) to check that the account really controls that domain before anything is served on it. This…
Smarter runs two small pieces of Django middleware whose only job is to make automated vulnerability scanners go away. One refuses requests for files like .env, .git/config and id_rsa, and the other blocks anonymous clients that keep asking for pages…
smarter is the command-line interface of The Smarter Project. It is to the Smarter API what kubectl is to Kubernetes. You describe a resource in a YAML file, and smarter apply makes the platform match it. The same program lists…