Brytebridge SDLC Standards

Brytebridge SDLC standards—these are developing standards for how we build, deploy, and operate services.

Patterns

Zero Trust

Log, minimum permissions, verify, automate production.

Naming conventions

staging, main, repo → Fly app, Mongo IP labels, key checklist.

Branches

Sacred branches: staging, uat, main → fly.*.toml.

---

Goals

SDLC goals

Why we standardize—SOC 2, one mental model, safer defaults, faster onboarding.

Timeline & roadmap

Phase 1 now—reviewing AWS / Fly. Observability, consensus, Penn Station test, key rotation ahead.

Rotation inventory

Fly, Mongo, Auth0, AWS—prioritized high to low; schedules TBD.

---

Stack Components

Fly.io

Dockerized apps—we use Fly.io for APIs.

Cloudflare

Our public front door—static sites and secure API routing.

Fly tunnel

No public Fly ports—org tunnels, each app registers.

AWS

Only what must stay—storage, enterprise, shared platform.

GitHub

Sacred branches, Actions deploys, secrets by component.

MongoDB

Atlas per tier—MONGODB_URI on Fly, egress IP allowlists.

Auth0

Login and API tokens—identity secrets on Fly per tier.

Grafana

Logs, metrics, and dashboards—Grafana Cloud, not AWS VMs.

Sentry.io

Error radar for production—and smarter monitoring ahead.

Algolia

Hosted search indexes—API sync, search-only keys in UIs.