Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
••••••••••••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Ship Production Apps in Days, Not Months: We Open-Sourced Our Entire Infrastructure Stack

Ship Production Apps in Days, Not Months There are millions of Python packages and millions of ways to build an app. You can spend weeks wiring together auth libraries, job queues, webhook handlers, LLM providers, banking APIs—thousands …

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




Ship Production Apps in Days, Not Months



There are millions of Python packages and millions of ways to build an app.



You can spend weeks wiring together auth libraries, job queues, webhook handlers, LLM providers, banking APIs—thousands of lines of glue code before you write a single line of business logic.



We think that's backwards.



After years of building SaaS products and rewriting the same infrastructure patterns, we extracted everything into three focused packages and open-sourced them.



One goal: developer experience.




pip install svc-infra ai-infra fin-infra






Let me show you what's inside — and how to get something real running in a few minutes.









Who This Is For




  • Backend engineers who are tired of rebuilding auth, billing, jobs, and webhooks.

  • AI engineers and agents who want reliable, non‑hallucinated infrastructure primitives.

  • Fintech builders who just want Plaid, portfolios, and cashflow analytics to "just work".



If you reach for FastAPI, LangGraph, or Plaid more than once a year, this stack is for you.









From Zero to API in 5 Minutes



Here is the kind of thing you can have running before your coffee cools down:




from svc_infra.api.fastapi.ease import easy_service_app
from svc_infra.api.fastapi.auth import add_auth_users
from svc_infra.api.fastapi.db.sql.add import add_sql_db
from svc_infra.jobs.easy import easy_jobs

app = easy_service_app(name="MyAPI", release="1.0.0")
add_sql_db(app)
add_auth_users(app)
queue, scheduler = easy_jobs()

@app.post("/api/process")
async def process(user=Depends(current_active_user)):
queue.enqueue("heavy_task", {"user_id": user.id})
return {"status": "queued"}






You get a real API with auth, database, and background jobs — no glue code, no YAML explosion.









The Problem



Every project starts the same way:




  1. ✅ Set up FastAPI

  2. ⏳ Add authentication (JWT? Sessions? OAuth? MFA?)

  3. ⏳ Wire up a database with migrations

  4. ⏳ Need background jobs? Set up Redis, write a worker, handle retries

  5. ⏳ Want webhooks? Implement HMAC signing, retries, delivery tracking

  6. ⏳ Add AI features? Integrate OpenAI, then Anthropic, then Google...

  7. ⏳ Fintech app? Figure out Plaid, handle bank account syncing



By the time you've written all the infrastructure, you've lost momentum. The actual product idea sits waiting.



And here's the thing: AI agents have the same problem.



With tools like Cursor, Copilot, and Devin writing code autonomously, we noticed something: agents are great at business logic but struggle with infrastructure. They hallucinate auth flows, mess up webhook signatures, reinvent caching patterns with subtle bugs.



Both humans and AI need standardized, battle-tested infrastructure.









Package 1: svc-infra (Backend Infrastructure)



Everything you need to ship a SaaS backend, wired in one function call.






Quick Start






from svc_infra.api.fastapi.ease import easy_service_app
from svc_infra.api.fastapi.auth import add_auth_users
from svc_infra.api.fastapi.db.sql.add import add_sql_db
from svc_infra.jobs.easy import easy_jobs

# Create app with batteries included
app = easy_service_app(name="MyAPI", release="1.0.0")

# Add infrastructure
add_sql_db(app) # PostgreSQL with migrations
add_auth_users(app) # Full auth system
queue, scheduler = easy_jobs() # Background jobs

# Your business logic - that's it!
@app.post("/api/process")
async def process(user=Depends(current_active_user)):
queue.enqueue("heavy_task", {"user_id": user.id})
return {"status": "queued"}






That's a production-ready API with auth, database, and background jobs.






What's Included




















































Feature What You Get
Auth JWT, sessions, OAuth/OIDC, MFA/TOTP, API keys, password policies
Billing Usage tracking, subscriptions, invoices, Stripe sync
Jobs Redis queue, retries, exponential backoff, dead letter queue
Webhooks Subscriptions, HMAC-SHA256 signing, delivery retries
Cache Redis/memory, decorators, namespacing, TTL helpers
Observability Prometheus metrics, health probes, OpenTelemetry
Database PostgreSQL + MongoDB, Alembic migrations
Storage S3, local, memory backends
Rate Limiting Per-user, per-endpoint, with headers
Multi-tenancy Tenant isolation built-in





Real Example: Auth System



Here's what add_auth_users(app) gives you:




# Automatic routes registered:
# POST /auth/register
# POST /auth/login
# POST /auth/logout
# POST /auth/forgot-password
# POST /auth/reset-password
# POST /auth/verify
# GET /auth/me
# POST /auth/mfa/setup
# POST /auth/mfa/verify
# Plus OAuth routes for each provider...






With one function call, you get:




  • JWT tokens with refresh

  • Session cookies

  • OAuth/OIDC (Google, GitHub, etc.)

  • MFA/TOTP

  • Password policies and breach checking

  • Account lockout

  • Key rotation support



Customizable when you need it:




add_auth_users(
app,
jwt_lifetime_seconds=3600,
enable_mfa=True,
oauth_providers=["google", "github"],
password_min_length=12,
require_email_verification=True,
)






GitHub: github.com/nfraxio/svc-infra









Package 2: ai-infra (AI/LLM Infrastructure)



One interface for LLMs, agents, RAG, and MCP—across 10+ providers.






Quick Start






from ai_infra import LLM, Agent, Retriever

# Chat with any provider
llm = LLM() # Uses OPENAI_API_KEY by default
response = llm.chat("Explain quantum computing")

# Switch providers with one line
llm = LLM(provider="anthropic", model="claude-sonnet-4-20250514")
response = llm.chat("Same question, different model")









Build an Agent with Tools






from ai_infra import Agent

def get_weather(city: str) -> str:
"""Get current weather for a city."""
return f"72°F and sunny in {city}"

def search_docs(query: str) -> str:
"""Search internal documentation."""
return db.search(query)

agent = Agent(tools=[get_weather, search_docs])
result = agent.run("What's the weather in Tokyo and how do I configure auth?")
# Agent automatically calls both tools and synthesizes the answer









RAG in 5 Lines






from ai_infra import Retriever

retriever = Retriever()
retriever.add_file("company_docs.pdf")
retriever.add_file("product_manual.md")

results = retriever.search("How do I reset my password?")






Multiple backends supported:




# Development
retriever = Retriever(backend="memory")

# Local persistence
retriever = Retriever(backend="sqlite", path="./vectors.db")

# Production
retriever = Retriever(backend="postgres", connection_string="...")
retriever = Retriever(backend="pinecone", index_name="my-index")









MCP (Model Context Protocol) Support



Full MCP client with interceptors:




from ai_infra import MCPClient
from ai_infra.mcp import RetryInterceptor, CachingInterceptor

async with MCPClient(
"http://localhost:8080",
interceptors=[
RetryInterceptor(max_retries=3),
CachingInterceptor(ttl=300),
]
) as client:
tools = await client.list_tools()
result = await client.call_tool("search", {"query": "test"})






Create MCP servers from plain functions:




from ai_infra import mcp_from_functions

def search_docs(query: str) -> str:
"""Search documentation."""
return db.search(query)

def get_user(user_id: str) -> dict:
"""Get user details."""
return {"id": user_id, "name": "John"}

mcp = mcp_from_functions(
name="my-mcp",
functions=[search_docs, get_user]
)
mcp.run(transport="stdio")









Supported Providers
















































































Provider Chat Embeddings TTS STT Images
OpenAI ✅ ✅ ✅ ✅ ✅
Anthropic ✅ - - - -
Google ✅ ✅ ✅ ✅ ✅
xAI (Grok) ✅ - - - -
Ollama (local) ✅ ✅ - - -
ElevenLabs - - ✅ - -
Deepgram - - - ✅ -
Stability - - - - ✅


GitHub: github.com/nfraxio/ai-infra









Package 3: fin-infra (Financial Infrastructure)



Production-ready financial data for fintech apps.






Quick Start






from fin_infra.banking import easy_banking
from fin_infra.investments import easy_investments
from fin_infra.markets import easy_market

# Connect bank accounts via Plaid
banking = easy_banking(provider="plaid")
accounts = await banking.get_accounts(access_token)
transactions = await banking.get_transactions(account_id)

# Investment holdings with real P/L
investments = easy_investments(provider="plaid")
holdings = await investments.get_holdings(access_token)
for h in holdings:
print(f"{h.symbol}: {h.quantity} shares, P/L: ${h.unrealized_gain}")

# Market data
market = easy_market()
quote = market.quote("AAPL")
print(f"AAPL: ${quote.price}")









Financial Calculations






from fin_infra.cashflows import npv, irr, loan_payment

# Net Present Value
cashflows = [-100000, 30000, 30000, 30000, 30000]
value = npv(rate=0.08, cashflows=cashflows)

# Internal Rate of Return
rate = irr(cashflows)

# Loan payments
monthly = loan_payment(principal=250000, rate=0.065, years=30)









What's Included





  • Banking: Plaid/Teller integration, accounts, transactions


  • Investments: Holdings with cost basis, real P/L, asset allocation


  • Market Data: Stocks, crypto, forex quotes and history


  • Credit: Credit scores and monitoring


  • Analytics: Cash flow, savings rate, spending insights


  • Calculations: NPV, IRR, loan amortization



GitHub: github.com/nfraxio/fin-infra









The Philosophy






1. Developer Experience is Everything



There are a million ways to build an app. We obsessed over making infrastructure disappear so you can ship in days, not months—in 10 lines, not 1000.






2. Sensible Defaults, Full Flexibility



Every function works out of the box with zero configuration. But everything is customizable:




# Just works
app = easy_service_app(name="MyAPI")

# Customized
app = easy_service_app(
name="MyAPI",
enable_cors=True,
cors_origins=["https://myapp.com"],
enable_metrics=True,
metrics_path="/custom-metrics",
)









3. Composable, Not Monolithic



Use svc-infra alone for a SaaS. Add ai-infra for AI features. Add fin-infra for fintech. They work together but don't require each other.






4. Production-Tested



We run these in production. Not a weekend project—actual error handling, retries, observability, battle-tested patterns.









What's Next



These three packages are just the beginning.



We're expanding to cover more domains—healthcare, e-commerce, IoT, whatever developers need.



We're going multi-language. The goal is the same across any language or framework: developer experience, simplicity, full flexibility, production readiness.



TypeScript, Go, Rust—all coming. Ship production-ready apps fast, in any language.









Get Started






pip install svc-infra ai-infra fin-infra






All MIT licensed. Full docs in each repo.



Links:











Questions?



Drop a comment below! Happy to discuss:




  • Architecture decisions we made

  • Tradeoffs and why

  • How specific features work

  • What you'd like to see added



We built this because we got tired of rewriting the same patterns. Hoping it saves you time too.



⭐ Star us on GitHub if this is useful!

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Ship Production Apps in Days, Not Months: We Open-Sourced Our Entire Infrastructure Stack
id: 71d15166-a1ea-49d5-977a-53ce4c0ae813
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Ship Production Apps in Days, " ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Ship Production Apps in Days Not Months ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Ship Production Apps in Days Not Months *"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Ship Production Apps in Days Not Months "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph4 Knoten / 3 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Ship Production Apps in Days, Not Months.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Ship Production Apps in Days, Not Months: We Open-Sourced Our Entire Infrastructure Stack

Thematisch verwandte Begriffe: Ship, Production, Apps, Days · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-87722 | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search q…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle