Enclii
[!IMPORTANT]
MADFAM-ENCLII-FIRST-LEGACY-RAW v1: This document contains legacy raw infrastructure command examples.
Routine production operations must use Enclii web, API, or CLI. Treat raw
kubectl, helm, SSH, provider CLI/API, docker exec, and direct container
access as platform bootstrap or documented break-glass only, and record any
missing Enclii adapter gap.
Deploy, scale, and operate — on infrastructure you own.
Open source DevOps platform with production-grade Kubernetes on Hetzner + Cloudflare.
Status: Production-running beta | Production Checklist →
Authentication: OIDC via Janua SSO (RS256 JWT) - Integrated
Infrastructure: Hetzner Dedicated + Cloudflare - Running
What is Enclii?
Enclii is an open source DevOps platform for deploying, scaling, and operating containerized services with enterprise-grade security, GitOps automation, and zero vendor lock-in.
Self-Hosted Production
"We run our entire platform on Enclii, authenticated by Janua. We are our own most demanding customer."
Production Services:
- ✅ Control Plane API (
api.enclii.dev)
- ✅ Web Dashboard (
app.enclii.dev)
- ✅ Admin Platform (
admin.enclii.dev)
- ✅ Authentication (
auth.madfam.io) → Janua SSO (OIDC)
- ✅ Documentation (
docs.enclii.dev)
- ✅ Landing Page (
enclii.dev)
- ✅ Status Page (
status.enclii.dev, status.madfam.io)
All services deploy via zero-touch onboarding — K8s manifests and CI workflows live in each repo, not here. See onboarding guide →
MADFAM Operations Doctrine
Enclii is the required control plane for MADFAM DevOps and provisioning:
- Enclii web, API, and CLI are mandatory for routine production provisioning, deployment, observability, domains, secrets, provider operations, scaling, rollback, and remediation.
enclii ops replaces routine kubectl, ArgoCD, Longhorn, Kyverno, ExternalSecrets, Vault, and ARC manipulation.enclii providers replaces routine gh, Cloudflare, Porkbun, and Hetzner manipulation.- Switchyard API is the agent-facing contract Selva and other agents should call.
- Raw
kubectl, helm, SSH, provider CLIs/APIs, docker exec, and direct container access are allowed only for platform bootstrap or documented break-glass emergencies when Enclii is unavailable or lacks an implemented adapter.
- Missing adapter gaps must be recorded and remediated in Enclii rather than normalized as routine operator procedure.
Role in the MADFAM monetization engine
Enclii does not sell the products in MADFAM's commercial pipeline — it runs them. Demand discovery, pricing,
checkout, invoicing, entitlement, and CRM each live in their own service, and every one of those services is
deployed, scaled, observed, and rolled back through Enclii. That makes Enclii's reliability a direct commercial
dependency rather than a supporting concern: degraded operations here degrade the ability to take money at all.
Enclii is also itself a commercial product, with its own tiers, offered through the same pipeline it operates.
Commercial licensing terms are in COMMERCIAL_LICENSE.md.
Readiness against that responsibility is tracked in
docs/MONETIZATION_PATH_READINESS.md. This section describes Enclii's
designed role; it is not a statement about the live state of any deployment.
Boundary checkpoint (2026-07-26, docs change, pending maintainer review): public-safe role statement only. What was withheld — deployment
topology, credential and secret names, per-service operational state, cost, and incident detail; the canonical
end-to-end description of the monetization pipeline is private and lives in internal-devops at
docs/monetization-engine.md, referenced here by path and not reproduced. Policy:
docs/PUBLIC_REPO_BOUNDARY.md and the
repo-boundary contract.
Last Updated: 2026-07-26
Key Features
🏗️ Production-Running Beta Infrastructure
Current Hetzner Topology:
| Surface | Role | Hardware |
|---|
| The Sanctuary | Production workloads | Hetzner dedicated server |
| The Forge | CI/CD builder capacity | Hetzner Cloud VPS |
Cost-Optimized Stack:
- Cloudflare Tunnel - Zero-trust ingress (replaces load balancers)
- Cloudflare for SaaS - 100 custom domains FREE
- Cloudflare R2 - Zero-egress object storage
- Self-hosted PostgreSQL - In-cluster with persistent storage
- Self-hosted Redis - In-cluster caching (Sentinel ready for multi-node)
Builder Node Targeting: Build workloads are steered to builder-role nodes with Kubernetes taints (builder=true:NoSchedule). Not every builder-role node is tainted yet, so production workloads can still land on one; tightening that placement is open work.
Infrastructure Audit (Jan 2026): Evaluated Ubicloud managed PostgreSQL and Redis Sentinel. Decision: NOT NEEDED at this stage. Sentinel manifests staged for future multi-node deployment.
Self-hosted infrastructure is significantly cheaper than equivalent SaaS platforms, but the platform is still a production-running beta until the remaining blockers below are closed.
View infrastructure details →
🔐 Authentication & Security (Production Ready)
OIDC/OAuth 2.0 - Full Implementation:
- ✅ Janua SSO Integration - Self-hosted OAuth 2.0/OIDC provider
- ✅ RS256 JWT Signing - RSA 2048-bit keys with JWKS rotation
- ✅ External JWKS Validation - Federated identity support
- ✅ PKCE Support - Secure authorization code flow
- ✅ Token Refresh - Automatic refresh with rotation
Social & Enterprise Auth:
- ✅ GitHub OAuth - Repository imports with linked accounts
- ✅ Google OAuth - One-click sign-in
- ✅ Microsoft OAuth - Azure AD integration ready
- ✅ SAML 2.0 SSO - Enterprise IdP support via Janua
Access Control:
- ✅ RBAC - Admin/Developer/Viewer roles with granular permissions
- ✅ Multi-Tenant Organizations - Namespace isolation per tenant; tenant administrators reach only their own tenants (ADR-003, enforced in production since 2026-10-18)
- ✅ API Keys - Service accounts for CI/CD pipelines
- ✅ Session Management - Redis-backed with secure cookies
Security Hardening:
- ✅ Rate Limiting - 1,000-10,000 req/min tiers (behind the tunnel the per-IP limiter needs
ENCLII_TRUSTED_PROXY_CIDRS, still an operator TODO in production; see SECURITY.md)
- ✅ Security Headers - HSTS, CSP, X-Frame-Options
- ✅ Audit Logging - Immutable security event trail
- ✅ RP-Initiated Logout - Full SSO session termination
Cost Advantage:
- ✅ $0/month vs Auth0 ($220+) or Clerk ($300+)
- ✅ No per-MAU pricing - Unlimited users
- ✅ No vendor lock-in - Own your auth infrastructure
View auth architecture →
🚀 Multi-Tenant SaaS Ready
Cloudflare for SaaS enables unlimited custom domains:
- ✅ First 100 domains FREE
- ✅ $0.10/domain after that
- ✅ Auto-provisioned SSL in ~30 seconds
- ✅ No cert-manager rate limits
- ✅ No Kubernetes overhead
Perfect for: SaaS platforms serving multiple customers with custom domains.
📦 Complete Feature Set
Developer Experience:
- Intuitive CLI (
enclii init, enclii deploy, enclii logs)
- Auto-detect buildpacks (Nixpacks, Buildpacks, Dockerfile)
- Preview environments on every PR
- Real-time log streaming
Security & Compliance:
- RS256 JWT authentication with RSA signing
- RBAC with admin/developer/viewer roles
- Rate limiting (1,000-10,000 req/min)
- Security headers (HSTS, CSP, X-Frame-Options)
- Audit logging with immutable trail
- Image signing (Cosign) + SBOM (CycloneDX)
Operations:
- Canary deployments with auto-rollback
- Instant rollback (
enclii rollback --instant)
- Horizontal pod autoscaling (HPA)
- Redis caching with tag-based invalidation
- PgBouncer connection pooling
- Prometheus + Grafana monitoring
Multi-Tenancy:
- NetworkPolicies (zero-trust networking)
- ResourceQuotas per tenant
- Per-tenant metrics and logging
- Cost tracking and showback
Architecture
Repository Structure (Monorepo)
enclii/
├── apps/
│ ├── switchyard-api/ # Control plane API (Go)
│ ├── switchyard-ui/ # Web dashboard (Next.js)
│ └── roundhouse/ # Build workers (Go)
├── packages/
│ └── cli/ # `enclii` CLI (Go)
├── infra/
│ ├── k8s/ # Kubernetes manifests
│ │ ├── base/ # Core infrastructure
│ │ ├── staging/ # Staging overlays
│ │ └── production/ # Production overlays
│ └── terraform/ # Infrastructure as Code
├── docs/ # Documentation
└── examples/ # Sample service specs
Component Names
Production Names (all railroad-themed 🚂):
- Switchyard - Control plane API
- Conductor - CLI (
enclii command)
- Roundhouse - Build/provenance/signing workers
- Junctions - Ingress/routing/DNS/TLS
- Timetable - Cron jobs and scheduled tasks
- Lockbox - Secrets management (Vault client + ESO in production)
- Signal - Observability (implemented:
/v1/observability/*, Prometheus + Grafana)
- Waybill - Infrastructure cost metering and usage showback
Production Readiness
Current Status: Production-Running Beta
From PRODUCTION_CHECKLIST.md:
Infrastructure (Complete):
- ✅ Hetzner Cloud k3s cluster running
- ✅ Cloudflare Tunnel integration
- ✅ PostgreSQL with health checks
- ✅ Redis for caching/sessions
- ✅ NetworkPolicies for zero-trust
Authentication (Complete):
- ✅ OIDC via Janua SSO (RS256 JWT)
- ✅ External JWKS validation
- ✅ GitHub OAuth linked accounts
- ✅ RBAC with role-based access
Build Pipeline (Complete):
- ✅ GitHub webhook CI/CD
- ✅ Buildpacks/Dockerfile detection
- ✅ Container registry push (ghcr.io)
- ✅ Real deployments (not simulated)
Remaining blockers before full production-ready status:
- ⚠️ Load testing validation against expected production traffic and failure modes
- ⚠️ Final security audit with documented remediation status
- ⚠️ Documented backup restore drill for PostgreSQL, Redis, and critical platform state
- ⚠️ HA/multi-node expansion plan and failover runbook for components that still depend on single-instance capacity
View production checklist →
Quick Start
Deploy your first service (5 minutes)
If you just want to ship an app to Enclii, the fastest path is:
VERSION=v1.0.0-alpha.14
OS=linux # use darwin for macOS
ARCH=amd64 # use arm64 on Apple Silicon or ARM Linux
curl -LO "https://github.com/madfam-org/enclii/releases/download/${VERSION}/enclii_${VERSION}_${OS}_${ARCH}.tar.gz"
tar -xzf "enclii_${VERSION}_${OS}_${ARCH}.tar.gz"
sudo install -m 0755 "enclii_${VERSION}_${OS}_${ARCH}/enclii" /usr/local/bin/enclii
enclii login
cd my-app && enclii init
enclii deploy
# → Live at https://dev.my-app.enclii.dev
Full 5-minute quickstart → docs.enclii.dev/quickstart
Migrating from another platform?
Run your own Enclii cluster
This repository contains the full source for Enclii itself. If you're bootstrapping a self-hosted cluster (bare-metal or cloud), continue below. Most users don't need to do this — app.enclii.dev is the hosted control plane.
Core:
- Docker ≥ 24
- kubectl ≥ 1.29
- kind ≥ 0.23 (for local dev)
- Helm ≥ 3.14
Languages:
- Go ≥ 1.22
- Node.js ≥ 20
- pnpm ≥ 9
macOS:
brew install go node pnpm kind helm kubectl docker
NPM Registry Configuration
Enclii uses MADFAM's private npm registry for internal packages. Configure your .npmrc:
# Add to your project's .npmrc or ~/.npmrc
@madfam:registry=https://npm.madfam.io
@enclii:registry=https://npm.madfam.io
@janua:registry=https://npm.madfam.io
# Auth token only needed for publishing (not for installing @enclii/* or @janua/* packages)
//npm.madfam.io/:_authToken=${NPM_MADFAM_TOKEN}
@enclii/* and @janua/* packages have public read access — no token required for npm install. The NPM_MADFAM_TOKEN is only needed for publishing or installing private scopes (@madfam/*, @dhanam/*, etc.).
[!IMPORTANT]
_authToken above is for NPM_MADFAM_TOKEN only — a Verdaccio-issued JWT
used by CI. If you are a person holding a Janua API key (jnk_…), it goes
in _auth as HTTP Basic, never in _authToken:
npm config set //npm.madfam.io/:_auth "$(printf 'janua:%s' "$JANUA_API_KEY" | base64)"
A Janua key in _authToken fails silently — Verdaccio verifies a Bearer
token as its own JWT before any auth plugin runs, and the failure degrades to
anonymous, so you get "authorization required" with no sign the key was
seen. And npm login here authenticates against htpasswd, not Janua;
it needs --auth-type=legacy.
See NPM Registry for details, including
which credential to use.
# 1. Clone and bootstrap
git clone https://github.com/madfam-org/enclii
cd enclii
make bootstrap # Install dependencies
# 2. Start local Kubernetes
make kind-up # Create kind cluster
make infra-dev # Install NGINX Ingress, cert-manager, Prometheus
make dns-dev # Configure dev DNS
# 3. Run the platform
make run-switchyard # Control plane API on :8001
make run-ui # Web UI on http://localhost:8030
# 4. Try the CLI
make build-cli
./bin/enclii init # Scaffold a service
./bin/enclii previews list # PR preview environments
./bin/enclii deploy --env prod # Deploy to production
./bin/enclii logs api -f # Tail logs
Detailed platform-contributor setup →
See Production Deployment Roadmap for the complete 8-week implementation plan.
Bootstrap:
# Provision Hetzner cluster
hcloud server create --name enclii-node-{1,2,3} --type cpx31
# Configure Cloudflare Tunnel
cloudflared tunnel create enclii-production
# Bootstrap-only: first cluster/platform install before Enclii can manage itself.
kubectl apply -k infra/k8s/production
CLI Reference
Boundary checkpoint (2026-09-24, platform ops): public-safe CLI usage only,
checked against enclii --help for v1.0.0-alpha.11. No operational detail was
added or withheld here. Policy: docs/PUBLIC_REPO_BOUNDARY.md.
enclii login # Authenticate via Janua SSO
enclii init # Create a service.yaml from a framework template
enclii deploy # Build and deploy the service in ./service.yaml (rolling, or --canary N)
enclii logs <service> # Show logs (-f to stream)
enclii ps # List services and their status
enclii secrets set # Manage secrets and environment variables
enclii domains add # Add a custom domain
enclii rollback # Revert to a previous deployment
enclii previews list # PR preview environments (created by the GitHub webhook)
Replica counts are set in service.yaml (replicas); there is no enclii scale command.
The full command reference is docs/cli/README.md.
Common workflows:
# Canary deploy to production: 10% of traffic, auto-promote after the validation window
enclii deploy --env prod --canary 10 --change-ticket https://tracker.example.com/CHG-1234
# Set secrets
enclii secrets set DATABASE_URL=postgres://... --secret --env prod
# Custom domain
enclii domains add api.example.com --service api --env prod
# Roll back to the previous deployment
enclii rollback api --env prod
Documentation
📚 Complete Documentation Index →
Getting Started:
Architecture:
Infrastructure (Jan 2026):
Audits & Reports:
Operations:
Key Differentiators
vs Railway ($2,000+/month)
| Feature | Railway | Enclii |
|---|
| Cost | Expensive | Self-hosted (fraction of SaaS cost) |
| Custom Domains | Limited, expensive | 100 FREE (Cloudflare for SaaS) |
| Vendor Lock-In | Full lock-in | None (portable Kubernetes) |
| Auth | Bring your own (expensive) | Janua included |
| Bandwidth | Expensive egress | Zero egress (Cloudflare R2) |
| Multi-Tenancy | Not designed for it | Built-in (NetworkPolicies, quotas) |
| Self-Hosting | Impossible | Fully self-hosted |
vs Vercel + Clerk
| Feature | Vercel + Clerk | Enclii |
|---|
| Cost | Expensive | Self-hosted (fraction of cost) |
| Backend Support | Limited (Functions) | Full container support |
| Database | Bring your own | Self-hosted PostgreSQL included |
| Auth | Clerk (expensive) | Janua included |
| Control | SaaS (no control) | Full control (self-hosted) |
The Self-Hosted Advantage
Why self-hosted infrastructure matters:
- Cost Control - Fraction of equivalent SaaS cost
- No Vendor Lock-In - Portable Kubernetes, standard tools
- Data Sovereignty - Your infrastructure, your rules
- Unlimited Scale - No artificial SaaS limits
- Self-Hosted Auth - No Auth0/Clerk dependency
- Custom Compliance - Meet any regulatory requirement
Roadmap
Phase 1: Foundation (Complete - 100%)
- ✅ Control plane API (Switchyard)
- ✅ CLI (
enclii init/up/deploy/logs)
- ✅ Web UI (Next.js dashboard)
- ✅ JWT authentication (RS256)
- ✅ RBAC (admin/developer/viewer)
- ✅ Preview environments
- ✅ Kubernetes reconciliation (embedded in control plane)
- ✅ Cloudflare Tunnel integration
- ✅ Redis caching
Phase 2: Janua Integration (Complete - 100%)
- ✅ OIDC/JWKS provider via Janua
- ✅ External JWKS validation
- ✅ OAuth 2.0 handlers
- ✅ Frontend OIDC integration
- ✅ Janua running at auth.madfam.io
- ✅ GitHub OAuth linked accounts
Phase 3: Production (Current - ~95%)
- ✅ Self-hosted (Enclii deploys itself)
- ✅ Real build pipeline (Buildpacks/Dockerfile)
- ✅ GitHub webhook CI/CD
- ✅ Container registry push (ghcr.io)
- ✅ ArgoCD GitOps deployment (Jan 2026)
- ✅ Longhorn CSI storage (Jan 2026)
- ✅ Cloudflare tunnel route automation (Jan 2026)
- ✅ Product bets A/B/C staging-proven (May 2026)
- ⚠️ Security release sign-off — SECURITY_RELEASE_PR.md
- ⚠️ 30-day SLO window — pending Wave 0+1
Phase 4: Commercial launch (in progress)
Master plan: COMMERCIAL_GA_MASTER_PLAN.md
- Wave 0–1: Ops closure (security, DR, Vault)
- Wave 2: Monetization QA (signup, pricing, Dhanam)
- Wave 3: 30-day SLO window → stability sign-off (Gate 4)
- Wave 4: SLA, support, legal publish → commercial launch (Gate 5)
Post-GA: multi-region, managed DB marketplace, KEDA custom metrics, full SOC 2 attestation.
Wave/gate status, readiness percentages, and dates live in COMMERCIAL_GA_TRACKER.md — the canonical tracker for current program state.
View production checklist →
Contributing
See CONTRIBUTING.md for the full guide. Quick checklist:
Boundary checkpoint (2026-06-04, platform owner): this public quick-start only
links the repository boundary policy and keeps private operational topology,
credential, cost, and incident detail in internal-devops. Policy:
docs/PUBLIC_REPO_BOUNDARY.md and
repo-boundary contract.
Keep implementation guidance public-safe. If a detail is private/sensitive, place it in internal-devops and link from here with a sanitized summary.
- Read CLAUDE.md for project conventions
- Run
make precommit before pushing
- Use conventional commits for changelog
- Open draft PR early for feedback
Security
Supply Chain Security:
- SBOM generation (CycloneDX format)
- Image signing (Cosign with RSA keys)
- Base image rotation every 30 days
- Vulnerability scanning (Trivy)
Runtime Security:
- Zero-trust networking (NetworkPolicies)
- Non-root containers (UID 65532)
- Read-only root filesystem
- Dropped Linux capabilities
- Seccomp profiles enabled
Security baseline (2026-09-30):
- Next.js 16.3.8 in every Next app:
apps/switchyard-ui, apps/admin-console (the dispatch image), apps/status and apps/landing. GHSA-vcvr-r3jv-pc5j is a critical RCE in next/og ImageResponse (>=16.2.0 <16.3.6); apps/admin-console/app/icon.tsx uses ImageResponse. Bumped in #659 (eslint-config-next to ^16.3.8 as well).
apps/status has its own lockfile. apps/status/Dockerfile installs from apps/status/pnpm-lock.yaml with --frozen-lockfile, so a Next bump must regenerate it as well as the root pnpm-lock.yaml (pnpm 9.15.9, the Dockerfile's pin). #659 missed it and the status image failed to build until #660.- The Node runner images carry no npm. The runner stage of
status, dispatch and switchyard-ui deletes npm and npx (#660). Trivy failed those images on HIGH CVEs that lived only in npm's own vendored tree (brace-expansion 5.0.9, undici 6.28.0), no npm release bundled the fixes, and the runtimes only execute node server.js (healthchecks use wget). CI job runner-npm-lint (scripts/check-runner-no-npm.py) keeps the deletion in place and rejects a runner CMD/HEALTHCHECK that calls npm. To add npm back to a runtime, follow the steps in that script's header: allowlist the service with a reason, and pin an npm whose bundled dependencies pass Trivy.
Security baseline (2026-10-18):
- libexpat 2.9.0-r0 floor in the
switchyard-api and docs-site images (CVE-2026-77214, #770): the scan gate had stopped their pins until the floor landed.
- API-token scopes are bounded by the owner's role (#767), and ADR-003 tenant scope is enforced in production (#800; runbook).
- Operator consoles stay in-cluster: the Vault UI and the Redpanda Console accept no ingress from the tunnel (#772).
- Forwarded client-IP headers are believed only from
ENCLII_TRUSTED_PROXY_CIDRS (#783); that variable is not set in production yet.
Responsible Disclosure:
Email: [email protected]
The Vision: Self-Hosted as Competitive Advantage
We run our entire production infrastructure on Enclii, authenticated by Janua.
When prospects ask "Can Enclii handle production?" — we answer with verifiable proof:
"We run our entire production on Enclii, deployed with our own platform."
Production services running today:
- Control Plane API at api.enclii.dev
- Web Dashboard at app.enclii.dev
- Admin Platform at admin.enclii.dev
- Janua Auth at auth.madfam.io
- Status pages at status.enclii.dev, status.madfam.io
Why this matters:
- Customer confidence: "If they trust it, we can too"
- Product quality: We find bugs before customers do
- Sales credibility: Authentic production usage metrics
License
This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) to protect the sovereignty of the infrastructure and ensure that all modifications remain open source when deployed as a network service.
Copyright (C) 2025 Innovaciones MADFAM SAS de CV
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see LICENSE or visit https://www.gnu.org/licenses/agpl-3.0.html.
Why AGPL-3.0?
The AGPL-3.0 license ensures that:
- Network Copyleft: Anyone running a modified version of Enclii as a network service must provide the source code to users
- Infrastructure Sovereignty: No vendor can take this code, modify it, and offer it as a proprietary service without sharing improvements
- Community Protection: All improvements and modifications must be contributed back to the community
- Freedom Preservation: Users retain the freedom to study, modify, and distribute the software
This aligns with the MADFAM Manifesto Section IV: protecting open infrastructure from proprietary capture.
For AI Agents
This repository includes machine-readable context files following the llmstxt.org spec:
- llms.txt — Compact overview with links to all key documentation
- llms-full.txt — Full inline context including architecture, commands, debugging, and infrastructure details
Links
Related repositories / contracts
| Repository | Contract | Defined in |
|---|
| janua | Identity provider for the control plane, the dashboard and the CLI (OIDC, RS256 JWKS). enclii provision oidc registers ecosystem OAuth clients against it. | docs/guides/ECOSYSTEM_INTEGRATION.md |
| janua | Machine-to-machine tokens between services that Enclii deploys: one confidential client per edge, scoped, with the client secret delivered through Enclii secrets. | docs/service-tokens.md |
| tezca (consumer) | Deploys on Enclii with its own build workflows: digest pins in k8s/production/, lifecycle events reported here, ArgoCD sync. Its root-lockfile deploy gap is documented on its side. | enclii.yaml, docs/deployment/PRODUCTION_DEPLOYMENT.md |
| Other ecosystem services (consumers) | Every product repo declares an enclii.yaml and deploys through Enclii, either with the reusable build-publish.yml or with its own workflows that pin digests. | This repo: docs/reference/service-spec.md, docs/guides/ZERO_TOUCH_CONTRACT.md, , |
Questions? Open an issue or contact the team at [email protected]
Ready to deploy? Start with PRODUCTION_DEPLOYMENT_ROADMAP.md 🚀
