# ADR-0001 — Production hosting

- **Status:** Accepted
- **Date:** 2026-09-18
- **Deciders:** RE360Muse engineering

## Context

RE360Muse is a Next.js PWA plus an Express Prisma API. The API needs a
long-lived Node process (JWT uploads, Paystack HMAC webhook, Socket.io,
ffmpeg). Listing photos and public Market traffic should not pay S3
egress as they grow. Operators are worldwide, with a strong Africa
footprint; the current AWS objects live far from that traffic.

Cloudflare **Hyperdrive** advertises Postgres and MySQL. It is a
connection pool and query accelerator **in front of an existing
database**, reachable only from **Cloudflare Workers**. It does not
host Postgres. It does not sit in front of Express on Lightsail.

## Decision

Launch on a hybrid stack:

- Cloudflare: DNS, TLS, CDN, and **R2** object storage.
- AWS Lightsail: Next.js app and Express API (one VM or two).
- AWS RDS PostgreSQL (not Lightsail disk, not Lightsail Database).
- AWS Amplify: this docs site (already in `amplify.yml`).

Do **not** put the OS API on Workers or Pages. Do **not** point
`DATABASE_URL` at Hyperdrive from `main-backend`. Do **not** switch the
API to MySQL.

## Consequences

Easier: image delivery and DDoS sit on Cloudflare. The API keeps Prisma,
sessions, websockets, and ffmpeg. R2 uses the existing S3 client via
`S3_ENDPOINT`.

Harder: two vendors. Lightsail does not autoscale; the next step is App
Runner or ECS with the same Node process. RDS must allow the Lightsail
VPC (peering), not the public internet, for the API.

Hyperdrive stays a documented option only if we later add a **Worker**
that reads Postgres (for example a public listing cache). That Worker
would pool to the **same RDS**. The Express API still talks to RDS
directly.

## Alternatives considered

| Option | Why not |
|--------|---------|
| Full Cloudflare (Pages + Workers + Hyperdrive + D1/R2) | Workers cannot run this Express API, Socket.io server, or ffmpeg. Hyperdrive does not replace RDS. |
| Full AWS (S3 + EC2/ECS from day one) | Works, but listing-image egress is the expensive part. ECS is premature until one Lightsail size-up is not enough. |
| Postgres on the Lightsail instance | Fills the box first. Backup and HA are worse than RDS. |
| Lightsail Database | Weaker than RDS; still migrate later. |
| MySQL on Hyperdrive | Product schema is PostgreSQL. |