How HubSEO Runs
The production platform behind hubseo.dev. Edge frontend, dedicated audit engine, EU data.
This page describes how the SaaS you use is actually operated. No infrastructure details you'd need to exploit, just the honest topology.
The two halves
The site and app run on Vercel's edge platform. Marketing pages, the
audit console, the dashboard, checkout: all served from Vercel with
automatic deployments on every merge to the main branch. This documentation
app is served from the same origin under /docs, proxied to a dedicated
docs service.
The audit engine runs on dedicated EU infrastructure (Contabo, Germany): a CPU-only server with a 12-core EPYC, 48 GB RAM, and 484 GB storage. Rendering a real browser per audit is heavy by nature, so the measurement work runs on hardware sized for it, separate from the website.
The audit engine's containers
App Container
The audit engine orchestration and REST API surface.
Browserless Chromium
Renders audited DOM and pages for Lighthouse lab passes in sandboxed isolation.
Lighthouse Sidecar
Executes mobile (Moto G Power) and desktop lab passes with raw HAR extraction.
FlareSolverr
Clears challenge interstitials that would otherwise block a fair fetch.
Redis Queue
Multi-worker-safe job queue with lease renewal and FOR UPDATE SKIP LOCKED.
Traefik Proxy
Automated Let's Encrypt TLS termination and host routing at the VPS edge.
Stalwart Mail
Self-hosted mail subsystem for transactional alerts and crawl completions.
The job queue is multi-worker-safe by design: lease claims, row locking
with FOR UPDATE SKIP LOCKED, lease renewal, and generation fencing. Audit
capacity scales by adding sidecar replicas, not by cutting corners inside a
run.
The database
Self-hosted Supabase (Postgres) on the same EU infrastructure, with the site and engine talking to it over an internal network. Row-Level Security with tenant-scoped policies is enforced at the database layer: see Security.
The docs you are reading
A Next.js app (Fumadocs) running on the audit engine's host, exposed only
through TLS-terminating reverse proxy, and reachable publicly as
hubseo.dev/docs. Content changes deploy automatically from the main
branch. The canonical URL is always the hubseo.dev path; the origin host
is intentionally not indexed as a duplicate.
Release discipline
- Every change to production passes typecheck, lint, a zero-fixture guard that fails the build on simulated data, and the full test suite.
- Deploys are automatic on merge; incidents are handled by instant rollback to the last known-good deployment first, investigation second.
- Runtime health is exposed at
/api/health, which reports the running release so a served page can always be tied to a commit.
Data residency
Production data lives in the European Union: audit engine, database, mail, and the docs service all run in Germany; the site runs on Vercel's platform. See Data control.