Operate

Infrastructure

A single Compose stack runs everything the backends depend on, with observability built in from the first start. The same folder is copied into every project the CLI generates.

infra/local · infra/testing · infra/deploymentsChecked against the files 16 October 2026

Local stack

infra/local/compose.yaml binds every port to 127.0.0.1. Optional services sit behind Compose profiles; .env.example enables storage and mail, so NATS is opt-in until you run a split.

Service	Image	Host ports	Profile
PostgreSQL	`postgres:18.6-alpine`	`55432`	always
Redis	`redis:8.10.1-alpine`	`56379`	always
Observability	`grafana/otel-lgtm:0.32.1`	Grafana `3301`; OTLP for Go `14317`/`14318`, for Nest `14327`/`14328`	always
S3 storage	`chrislusf/seaweedfs:4.46`	`18333`	`storage`
Mailpit	`axllent/mailpit:v1.31.1`	SMTP `11025`, UI `18026`	`mail`
NATS JetStream	`nats:2.15.0-alpine`	`14222`, monitor `18222`	`events`

Commands

# from the repository root
make infra-up      # env, shared services, databases, roles, Mailpit

# from backend/go or backend/nest
make db-migrate    # apply that backend's migrations
make admin ARGS=…  # operator commands

# from infra/local
make infra-up      # full shared setup
make up            # enabled services only
make status        # make logs · make stop · make down
make dashboard     # open Grafana
make telemetry-check

make infra-up is owned by infra/local and can also be run from infra/. It does not start backend or frontend processes.

make up also applies the storage CORS rules the browser uploads need. There is deliberately no target that deletes data.

One PostgreSQL server provisions isolated databases for Go, Nest, Python, Rust, .NET, Java and Zig, so language implementations can use the same local dependency stack without sharing application data. Init scripts create the databases and runtime roles used by supported module configurations. Go and Nest are the v1 backends; Python, Rust, .NET, Java and Zig are in progress. Java and Zig currently apply the shared SQL migration history, while Rust and .NET migration parity is still in progress. SeeModule design. Migration parity status is recorded in backend/V1-READINESS.md.

Observability

One container runs the OpenTelemetry Collector, Prometheus, Loki, Tempo and Grafana. The collector has a separate intake for each backend and stamps bento.backend=go|nest, and it also watches PostgreSQL and Redis. What the backends may record is set by thetelemetry contract.

Bento overview

The home dashboard: dependency health, telemetry intake and export failures, firing alerts, application logs, Loki disk use, PostgreSQL connections and Redis clients.

Bento backends

Request rate, 5xx ratio and p95 latency by route, edge refusals and throttling, capability calls, outbox backlog and lag, dead events, job runs and database latency.

make telemetry-check sends a synthetic trace, metric and log and confirms each one arrived.

Alert rules

observability/alerts.yaml holds three groups. Locally they notify no one; the observability README maps severities to production routes and the security group to SOC 2 CC7.

Group	Rules
Local	Dependency unreachable, telemetry target down, dependency metrics missing, log storage above 85%, telemetry backlog.
Application	Server errors above 5%, outbox lag above 120 s, dead deliveries, a failing capability, a job failing three times in an hour.
Security	Sign-in denials, throttle trips, MFA failures, rate limiting, authorization denials, an audit chain break (critical), audit export lagging or stalled.

In generated apps

bento init <name> copies the chosen backend and frontend starters and, from this repository, the local stack (Compose file, Makefile and observability), the testing harness, and the HTTP contract with its type generator. It writes a unique Compose project name so several projects can run on one machine, and a bento.json recording the starters it used.

bento list                                   # starters found in backend/ and frontend/
bento init my-saas --backend go --frontend next

Deployment

Templates only

Production deployment

infra/deployments includes provider-neutral Alertmanager routing and Prometheus mTLS examples. It does not provision or deploy applications or infrastructure. Production still needs a hosting target, secret management, backups with restore checks, TLS and operational ownership; see Compliance.

Live

Frontend previews

deployments/showcase/vercel deploys the documentation to bento-dev.site and isolated frontend snapshots to next.bento-dev.site and svelte.bento-dev.site. These are UI showcases without a deployed backend; API-dependent actions need a configured backend origin.