Lobe Chat

Next.js app with server actions and API routes, optionally backed by Postgres for chat history/user data, but commonly deployed in a mode where provider API keys are entered and stored client-side in the browser.

The Next.js app tier is stateless and scales horizontally fine when chat history is stored in Postgres, but the popular client-side-API-key deployment pattern undermines the security model entirely — that mode should be avoided for any multi-user or production deployment regardless of how well the app tier itself scales.

Deploy as an app pod plus a postgres pod (postgres.pod:5432) for the server-persisted mode, and always configure model provider API keys as server-side env vars rather than the client-key mode to avoid leaking credentials to the browser. Mirror the base Node image via mirror.gcr.io.