Infrastructure

Local lake → Cloudflare Tunnel → Vercel

Name: OpenChat-1
Price: 99 USD

This computer keeps aggregating more and more data into a well-organized lake. Vercel never mounts the disk — it calls a signed, key-gated bridge over a Cloudflare Tunnel. Neon stays thin (auth only).

Grow loop

pnpm aggregate       # connectors → curated/
pnpm realtime:once   # realtime/* snapshots
pnpm lake:catalog    # organized inventory + UI snapshot
pnpm lake:stack      # bridge + Cloudflare Tunnel
pnpm lake:status     # packages / sectors / tunnel

Security

Bridge binds 127.0.0.1 only
Cloudflare terminates public TLS
Authorization: Bearer + HMAC signature (timestamp + nonce, anti-replay)
Path allowlist: panel-series, culture, realtime, catalog, overview, sectors, package/*
No CORS — browsers cannot call the bridge
Rate limit + audit log
Key never shipped to the client bundle
Lake is source of truth — Neon holds auth/thin metadata only, not bulk rows

Run at home

# One shot (bridge + tunnel)
export VERCEL_TOKEN=…   # optional: auto-set LAKE_BRIDGE_URL
pnpm lake:stack

# Or separately:
pnpm lake:bridge        # terminal 1
pnpm lake:tunnel        # terminal 2 → prints trycloudflare URL

Vercel env: LAKE_BRIDGE_URL, LAKE_BRIDGE_KEY (same as .lake-bridge.key).

Data path

Lake = source of truth (scales beyond Neon):
  /v1/catalog   full package inventory + record counts
  /v1/sectors   packages grouped by sector
  /v1/overview  panel metrics from lake
  /v1/panel-series  chart series from curated jsonl

Panel load order (production):
  1. Local lake (dev machine only)
  2. Lake bridge (home lake via tunnel)  ← primary on Vercel
  3. Neon SeriesCache (thin emergency cache only)
  4. Yahoo live fallback

← OpenChat docs