# CodeNx — full guide index > Practical guides for AI-assisted development, Cloudflare, VPS infrastructure, automation, deployment and modern software engineering. Each entry below summarises one published guide. Facts here are safe to quote with attribution to the article URL. Version-specific instructions must not be generalised beyond the environment listed under "Tested with". Generated 2026-08-03 · 28 guides · https://codenx.com --- ## Wildcard Subdomains and Automatic Cloudflare SSL for Multi-Tenant Apps URL: https://codenx.com/cloudflare/wildcard-subdomains-cloudflare-ssl-multi-tenant/ Type: troubleshooting · Difficulty: advanced Published: 2026-07-30 Last verified: 2026-07-27 Author: swadesh Topics: cloudflare, traefik, sveltekit, devops Direct answer: Point `*.example.com` at your edge, install a Cloudflare Origin CA certificate covering `example.com` and `*.example.com` as the origin's default cert, and route wildcards with Traefik's `HostRegexp` rather than `Host` — a literal `*.` in a `Host` rule matches nothing. If server-side rendering then returns 403, the cause is usually an SSR fetch resolving a relative `/api` path against the public hostname, so the request leaves your server and comes back through the CDN from a datacenter IP. Summary: Give every tenant its own subdomain with automatic DNS and SSL — and the 526 → 404 → 403 debugging trail behind it, including an SSR fetch that quietly hairpins out through your CDN. Tested with: traefik v3, sveltekit 2.x Prerequisites: - A domain already active on Cloudflare with Universal SSL enabled - A reverse proxy you control at the origin (Traefik here) - An application that resolves its tenant from the Host header Questions answered: - Why does a brand-new subdomain return 526 when its siblings work? — 526 means Cloudflare is in Full (strict) mode and could not validate the certificate your origin presented. Subdomains configured by hand have their own certificate; an un-provisioned one falls back to the origin's default self-signed certificate, which Full (strict) correctly rejects. A wildcard Origin CA certificate installed as the default fixes every current and future subdomain at once. - Why does a Traefik rule containing `*.example.com` never match? — Traefik's `Host` matcher compares literal hostnames, so the asterisk is treated as an ordinary character and the rule can never fire. Wildcard routing needs the `HostRegexp` matcher with a real regular expression. - Why does server-side rendering get 403 while the browser gets 200? — A relative fetch during SSR resolves against the current request's origin, which is the public hostname. The server therefore calls its own public domain, the request leaves the machine, reaches the CDN from a datacenter IP and is blocked as automated traffic. Rewriting server-side fetches to the internal backend address removes the round trip entirely. Primary sources: - Cloudflare Origin CA certificates: https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/ - Traefik routers and rule matchers: https://doc.traefik.io/traefik/routing/routers/ - SvelteKit server hooks — handleFetch: https://svelte.dev/docs/kit/hooks - Cloudflare IP Access Rules: https://developers.cloudflare.com/waf/tools/ip-access-rules/ --- ## Harden SSH on Ubuntu 24.04 with keys, fail2ban and UFW URL: https://codenx.com/vps/harden-ssh-ubuntu-fail2ban/ Type: configuration-guide · Difficulty: beginner Published: 2026-07-29 Last verified: 2026-07-27 Author: swadesh Topics: vps, ubuntu, security Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: You can log in as a non-root user with an SSH key, password and root logins are refused, fail2ban bans repeat offenders, and UFW allows only the ports you chose — verified by testing yourself out of the old login before closing it. Follow the steps below in order on Ubuntu 24.04 LTS, openssh-server 9.6p1, fail2ban 1.0.2, ufw 0.36.2; each one states the command to run and the output you should see, so you can stop at the first step that disagrees. Summary: A freshly provisioned Ubuntu VPS accepts root logins with a password, so automated scanners start guessing credentials within minutes of the host getting a public IP address, and the auth log Tested with: ubuntu 24.04 LTS, openssh-server 9.6p1, fail2ban 1.0.2, ufw 0.36.2 Prerequisites: - A server or workspace you can reach over SSH - Ubuntu 24.04 LTS, openssh-server 9.6p1, fail2ban 1.0.2, ufw 0.36.2 - Roughly 21 minutes Questions answered: - How much memory does Ubuntu need? — Answered in the article: see the What you need before you start and Fix the failures you will actually hit sections for the tested numbers rather than an estimate. - Can this run on a 2 GB VPS? — Answered in the article: see the What you need before you start and Fix the failures you will actually hit sections for the tested numbers rather than an estimate. - How do I roll back if the update breaks? — Answered in the article: see the What you need before you start and Fix the failures you will actually hit sections for the tested numbers rather than an estimate. Primary sources: - Ubuntu Server documentation: https://documentation.ubuntu.com/server/ - sshd_config(5) manual page: https://man.openbsd.org/sshd_config - UFW — Uncomplicated Firewall: https://help.ubuntu.com/community/UFW - OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/ --- ## Build a Delivery-Aware AI Diamond Ring Advisor with UCP URL: https://codenx.com/ai-agents/build-ai-diamond-ring-advisor-ucp/ Type: architecture-guide · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-07-27 Author: swadesh Topics: ai-agents, nodejs, sveltekit Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Build the grounded shopping assistant first. An LLM extracts intent, but deterministic commerce services own catalogue search, inventory, price and delivery. The Universal Commerce Protocol is an interoperability layer you add later to expose that same engine to external AI surfaces — it does not generate recommendations and does not replace your commerce backend. Summary: Turn a diamond-ring request into a delivery-aware buying experience built on real catalogue, inventory, price and delivery data — and see where UCP fits. Tested with: ucpSpecification spec 2026-04-08, googleMerchantCenterUcp early access, checked 2026-07-23 Prerequisites: - Familiarity with REST APIs and a product catalogue - A checkout flow you control - A basic understanding of how an LLM turns text into structured output Questions answered: - What is the Universal Commerce Protocol? — UCP is an open standard for interoperability between commerce businesses and external platforms such as AI agents and shopping surfaces. It defines common capabilities for catalogue, cart, checkout, payment and orders so a platform can discover and use a business's commerce services without a bespoke integration. The current specification is dated 2026-04-08. - Does UCP replace an ecommerce backend? — No. UCP sits over your existing product, cart, checkout, payment and order systems as an adapter. Your backend remains the source of truth for price, inventory and fulfilment; UCP only standardises how an external surface talks to it. - Does UCP provide AI product recommendations? — No. UCP standardises communication between commerce businesses and external platforms. Intent interpretation and recommendation ranking are not part of the protocol and must be built separately in your own catalogue search, inventory, pricing and ranking systems. - Can UCP be used for customised diamond rings? — Sometimes, but complex customisation — engraving, stone selection that changes price, resizing that needs confirmation — is usually better routed through an embedded or merchant-controlled checkout rather than forced into native agentic checkout. - Can the assistant guarantee delivery before an event? — Only when the underlying fulfilment and carrier systems support a genuine guarantee. Otherwise the assistant should show an estimated delivery date with an explicit confidence level, and warn the customer when the risk of missing the event is material. - Should a small store implement UCP first? — Usually not. First validate the internal conversational shopping and checkout experience and prove it improves conversion. Add UCP when external distribution through AI surfaces justifies the integration work. - Is Google's UCP checkout generally available? — Not as of 23 July 2026. Google's UCP-powered checkout is in early access for select merchants, gated behind Merchant Center onboarding, and limited to products eligible in the United States, Canada and Australia. Verify the current status against Google's official documentation before you plan a launch. Primary sources: - Universal Commerce Protocol — home: https://ucp.dev/ - UCP specification 2026-04-08 — overview: https://ucp.dev/2026-04-08/specification/overview/ - Universal Commerce Protocol specification repository: https://github.com/universal-commerce-protocol/ucp - About UCP and the UCP-powered checkout feature on Google: https://support.google.com/merchants/answer/16837055 - Google Marketing Live 2026 — Universal Commerce Protocol features: https://blog.google/products-and-platforms/products/shopping/shopping-updates-google-marketing-live/ --- ## Open Source Ecommerce Is Not Free: A Practical Total-Cost Model URL: https://codenx.com/ecommerce/open-source-ecommerce-cost/ Type: explainer · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-07-28 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: A free ecommerce licence only removes the software fee. Running WooCommerce, Magento Open Source, PrestaShop, Shopware or nopCommerce still means paying for hosting, extensions, PCI compliance, upgrade labour and maintenance staff — commonly several hundred to several thousand dollars a month once a store handles real traffic and card payments, before any developer time is added. Summary: A six-category framework for pricing self-hosted ecommerce ownership costs: licence, hosting, extensions, maintenance, security and staffing. Tested with: woocommerce 10.9.4 (WordPress.org, last updated 2026-07-07), magentoOpenSource 2.4.9, prestashop 9.1.4 (released 2026-06-04 per third-party release tracking; confirm on prestashop.com/versions before publication), shopware 6.7.12.1 (July 2026 patch line per Shopware's own changelog; confirm exact current patch version before publication), nopCommerce 4.90.6, license_woocommerce GPLv3 (inherited from WordPress core), license_magentoOpenSource OSL 3.0, license_prestashop OSL-3.0 (core), AFL-3.0 (modules), license_shopware6 MIT (core platform; commercial Rise/Evolve/Beyond tiers layered separately), license_nopCommerce nopCommerce Public License 4.0 (AGPLv3-derived, mandatory attribution clause), pricesCheckedAt 2026-07-28 Prerequisites: - Working familiarity with at least one open source ecommerce platform (WooCommerce, Magento Open Source, PrestaShop, Shopware or nopCommerce) — no fresh install required - Basic understanding of PCI DSS scope (SAQ tiers) is helpful for the compliance section but not assumed - No coding background needed; this is a cost-planning framework, not an installation or configuration guide Primary sources: - License - WordPress.org: https://wordpress.org/about/license/ - woocommerce/plugins/woocommerce/license.txt (GPLv3): https://github.com/woocommerce/woocommerce/blob/trunk/plugins/woocommerce/license.txt - WooCommerce - WordPress plugin directory listing: https://wordpress.org/plugins/woocommerce/ - WooCommerce Pricing: https://woocommerce.com/pricing/ - magento/magento2 LICENSE.txt (OSL 3.0): https://github.com/magento/magento2/blob/2.4-develop/LICENSE.txt - Adobe Commerce Pricing: https://business.adobe.com/products/commerce/pricing.html - PrestaShop/PrestaShop LICENSE.md: https://github.com/PrestaShop/PrestaShop/blob/develop/LICENSE.md - PrestaShop Versions: https://prestashop.com/versions/ - shopware/shopware LICENSE (MIT): https://github.com/shopware/shopware/blob/trunk/LICENSE - Shopware Pricing: https://www.shopware.com/en/pricing/ - Shopware Changelog: https://www.shopware.com/en/changelog/ - nopSolutions/nopCommerce LICENSE.md (nopCommerce Public License 4.0): https://github.com/nopSolutions/nopCommerce/blob/develop/LICENSE.md - Droplet Pricing - DigitalOcean: https://www.digitalocean.com/pricing/droplets - WP Engine Plans: https://wpengine.com/plans/ - How Much Does PCI Compliance Cost for Businesses?: https://stripe.com/resources/more/pci-compliance-cost - Official PCI Security Standards Council Site: https://www.pcisecuritystandards.org/ - Shopify Pricing: https://www.shopify.com/pricing - Web Developers and Digital Designers - Occupational Outlook Handbook: https://www.bls.gov/ooh/computer-and-information-technology/web-developers.htm --- ## Saleor vs Vendure: GraphQL Is the Similarity, Not the Decision URL: https://codenx.com/ecommerce/saleor-vs-vendure/ Type: comparison · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-07-28 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Saleor and Vendure both ship mature GraphQL APIs, so that isn't the deciding factor. The real split is in the operating model: Saleor Channels hold one currency and extend via out-of-process Apps under BSD-3-Clause, while Vendure Channels hold multiple currencies and extend via in-process GPLv3 Plugins, with B2B and managed cloud priced separately and unevenly. Summary: Saleor and Vendure both use GraphQL, but Channel currency limits, extension models, licences and B2B pricing set them apart. Tested with: saleor-core 3.23.22, saleor-license BSD-3-Clause, saleor-python-range >=3.12,<3.13, vendure-core 3.7.1, vendure-license GPLv3 (since v3.0, 17 July 2024), vendure-node-engines-range ^20.19.0 || >=22.12.0, docker 28.1.1, ubuntu 24.04 LTS, postgresql 17.5 Prerequisites: - Familiarity with GraphQL APIs and headless commerce concepts (Channels, storefronts, webhooks) - A team that has already narrowed its shortlist to Saleor and Vendure specifically, not a broader platform search - Docker 28.1.1, Ubuntu 24.04 LTS and PostgreSQL 17.5 available if you intend to verify any claim hands-on rather than take it from documentation - Access to the current Saleor Cloud and Vendure pricing pages, since prices can move after this comparison's research date Questions answered: - Which platform has a more mature GraphQL API, Saleor or Vendure? — Both ship complete, actively maintained GraphQL APIs (Saleor Core 3.23.22, Vendure Core 3.7.1). This comparison found no meaningful maturity gap between them — which is the point: GraphQL itself isn't the deciding factor, the Channel, extension, licence and B2B differences are. - Can I migrate from Saleor to Vendure, or vice versa, without a rebuild? — No official migration tool exists between the two platforms [needs verification]. Their Channel, permission and order data models aren't compatible, so a move means re-modelling data and rewriting storefront queries, not a straight import. - Does Vendure's GPLv3 licence stop me from building a closed-source storefront on top of it? — Not by itself — GPLv3 applies to Vendure Core, and Vendure's licensing page explicitly allows plugins to be released under any licence. Whether your specific deployment triggers GPLv3's copyleft terms depends on how you distribute modified Core code; treat that as a question for your own counsel, not something this article verified. Primary sources: - Saleor — official site: https://saleor.io/ - Pricing for Cloud Services – Saleor Commerce: https://saleor.io/pricing - Releases · saleor/saleor: https://github.com/saleor/saleor/releases - saleor/saleor LICENSE: https://github.com/saleor/saleor/blob/main/LICENSE - Channels | Saleor Commerce Documentation: https://docs.saleor.io/developer/channels/overview - Draft Orders | Saleor Commerce Documentation: https://docs.saleor.io/developer/order/draft-order - Build B2B commerce tailored to your business — Saleor: https://saleor.io/solutions/b2b-commerce - Extensions | Saleor Commerce Documentation: https://docs.saleor.io/developer/app-store/overview - GitHub - saleor/storefront: https://github.com/saleor/storefront - Vendure — official site: https://vendure.io/ - Vendure Pricing: https://vendure.io/pricing - Licensing | Vendure: https://vendure.io/licensing - B2B ecommerce platform: accounts and approvals | Vendure: https://vendure.io/solutions/b2b-commerce - Production-ready B2B storefront on Next.js | Vendure: https://vendure.io/product/platform/storefront - Vendure Plugin System | Vendure Core Docs: https://docs.vendure.io/guides/developer-guide/plugins/ - Add a REST endpoint | Vendure Core Docs: https://docs.vendure.io/guides/developer-guide/rest-endpoint/ - Channels | Vendure Docs: https://docs.vendure.io/guides/core-concepts/channels/ - GitHub - vendure-ecommerce/vendure: https://github.com/vendure-ecommerce/vendure - Changelog – v3.7.1 | Vendure Docs: https://docs.vendure.io/changelog?focus=v3.7.1 --- ## Sharetribe in 2026: Excellent for Marketplace Validation, but Where Is the Ceiling? URL: https://codenx.com/ecommerce/sharetribe-review/ Type: tool-review · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-08-01 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Sharetribe validates rental, booking and service marketplaces fast because Stripe Connect Custom handles split payouts inside a predefined transaction process out of the box. The ceiling appears at retail scale: a 100-unit stock cap per transaction, single-currency pricing by default, full-refund-only payments, and no PayPal support — each requiring custom code or a different platform to clear. Summary: Sharetribe speeds up rental, booking and service marketplace validation, but retail catalogues, multi-currency pricing and partial refunds hit a hard SaaS ceiling. Tested with: react 18.3.1, react-dom 18.3.1, react-router-dom 5.3.4, @reduxjs/toolkit 2.12.0, react-redux 9.2.0, express 5.2.1, node ^22.22.0 || >=24.0.0, sharetribe-web-template-license Apache-2.0 Prerequisites: - Familiarity with two-sided marketplace concepts: listings, bookings or orders, providers/hosts and payouts - A Sharetribe account with Console access to check Build > General > Localization and current plan pricing directly - Node.js ^22.22.0 or >=24.0.0 and the Sharetribe CLI installed if testing sharetribe-web-template or editing a transaction process locally - A Stripe account capable of creating Connect Custom accounts, since Sharetribe's built-in payment integration depends on it Questions answered: - What's the difference between Sharetribe Flex and the new Sharetribe? — Sharetribe dropped the 'Flex' name from its developer-facing product and now markets it simply as Sharetribe; verify current naming, plan structure and any feature changes against Sharetribe's own documentation before relying on older 'Flex' references. Primary sources: - Sharetribe — official site: https://www.sharetribe.com/ - Sharetribe pricing: https://www.sharetribe.com/pricing/ - Sharetribe pricing changelog: https://www.sharetribe.com/pricing/pricing-changelog/ - Sharetribe Web Template — introduction: https://www.sharetribe.com/docs/template/introduction/sharetribe-web-template/ - sharetribe/web-template GitHub repository (package.json, LICENSE): https://github.com/sharetribe/web-template - web-template AGENTS.md: https://github.com/sharetribe/web-template/blob/main/AGENTS.md - Rate limiting in Marketplace API and Integration API: https://www.sharetribe.com/docs/concepts/api-sdk/rate-limiting/ - Sharetribe API reference: https://www.sharetribe.com/api-reference/ - Build with AI — Sharetribe Developer Documentation: https://www.sharetribe.com/docs/introduction/build-with-ai/ - New in Sharetribe Docs: AI Assistant and MCP Server: https://www.sharetribe.com/changelog/docs-assistant-mcp/ - Introduction to transaction processes: https://www.sharetribe.com/docs/concepts/transactions/transaction-process/ - Edit an existing transaction process with Sharetribe CLI: https://www.sharetribe.com/docs/how-to/transaction-process/edit-transaction-process-with-sharetribe-cli/ - Stock type options — Sharetribe Help Center: https://www.sharetribe.com/help/en/articles/8943973-stock-type-options - Sharetribe customer case studies: https://www.sharetribe.com/customers/ - Build any type of marketplace with Sharetribe: https://www.sharetribe.com/any-marketplace/ - Payment methods overview — Sharetribe Developer Documentation: https://www.sharetribe.com/docs/concepts/payments/payment-methods-overview/ - How PaymentIntents work — Sharetribe Developer Documentation: https://www.sharetribe.com/docs/concepts/payments/payment-intents/ - How the listing search works — Sharetribe Developer Documentation: https://www.sharetribe.com/docs/concepts/listings/how-the-listing-search-works/ - Currency configurations — Sharetribe Developer Documentation: https://www.sharetribe.com/docs/template/configuration/how-to-set-up-currency-in-template/ - Hosted Marketplace Infrastructure — Sharetribe: https://www.sharetribe.com/features/hosted-cloud-infrastructure/ - Sharetribe Flex is now just Sharetribe: https://www.sharetribe.com/flex-is-now-sharetribe/ --- ## Sharetribe vs CS-Cart Multi-Vendor: Marketplace SaaS or Packaged Ownership? URL: https://codenx.com/ecommerce/sharetribe-vs-cs-cart/ Type: comparison · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-07-28 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Sharetribe is a subscription SaaS: you rent a closed-source backend, keep only an Apache-2.0 frontend template, and pay monthly fees plus per-transaction overage. CS-Cart Multi-Vendor is packaged PHP source you buy once or annually, install on your own server, and own outright with no per-transaction fee — trading launch speed for full code ownership. Summary: Sharetribe's subscription SaaS backend versus CS-Cart Multi-Vendor's owned PHP source, compared on launch speed, transaction limits, ownership and operations. Tested with: cs-cart-multi-vendor 4.20.1, cs-cart-multi-vendor-release-date 2026-02-24, cs-cart-php-minimum 7.4.0, cs-cart-php-8.2-required-from 4.18.1, cs-cart-php-8.3-supported-from 4.19.1, sharetribe-web-template-license Apache-2.0, sharetribe-web-template-latest-tag-unconfirmed v12.1.0 (2024-07-27 per one GitHub releases fetch — conflicts with later v11.x/v10.14.x references; re-verify before publishing), sharetribe-go-license Sharetribe Community Public Licence (deprecated product, formerly MIT) Prerequisites: - A Sharetribe account to start the 14-day free trial (no card required) if you want to test the SaaS path directly - A server or hosting environment running PHP 8.2 or 8.3 if you plan to self-host CS-Cart Multi-Vendor 4.20.1 (PHP 7.4.0 is only the historical minimum) - Node.js and the Sharetribe CLI installed if you intend to run sharetribe/web-template locally - Basic familiarity with marketplace concepts: vendors, listings, bookings or orders, payouts and commission models Primary sources: - Sharetribe Pricing — official pricing page: https://www.sharetribe.com/pricing/ - CS-Cart Multi-Vendor On-Premises — official pricing/compare page: https://www.cs-cart.com/compare - sharetribe/web-template — official GitHub repository (README, license): https://github.com/sharetribe/web-template - sharetribe/web-template — GitHub releases: https://github.com/sharetribe/web-template/releases - sharetribe/sharetribe — Sharetribe Go GitHub repository (deprecated, licence history): https://github.com/sharetribe/sharetribe - CS-Cart 4.20.x system requirements — official documentation: https://docs.cs-cart.com/latest/install/system_requirements.html - CS-Cart version history — official documentation: https://docs.cs-cart.com/latest/history/index.html - Introduction to transaction processes — Sharetribe Developer Documentation: https://www.sharetribe.com/docs/concepts/transactions/transaction-process/ - CS-Cart Multi-Vendor — official product page: https://www.cs-cart.com/multivendor - CS-Cart FAQ — official: https://www.cs-cart.com/faq.html - CS-Cart Add-On and Theme Marketplace (App Market) — official: https://marketplace.cs-cart.com/ - Sharetribe updates & releases — official changelog: https://www.sharetribe.com/changelog/ --- ## Spryker vs commercetools: Suite Modularity vs API Product URL: https://codenx.com/ecommerce/spryker-vs-commercetools/ Type: comparison · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-08-01 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Spryker is a source-available, 750+ module PHP/Symfony suite you assemble and typically run on its vendor-operated Cloud Commerce OS, licensed for only 45 days before a signed commercial agreement; commercetools is a closed-source, multi-tenant SaaS API with no self-host option, priced on orders rather than GMV, with no platform version number to cite. Summary: Feature checklists for Spryker vs commercetools miss the real split: licence and code access, integration limits, and operating model, not identical checkmarks. Tested with: spryker_release_train 202606.0 (documentation last updated 2026-07-07), spryker_php PHP 8.3+ required since 2025-08 (Symfony 6.4 requires PHP 8.2 minimum), spryker_symfony Symfony 6.4 LTS (5.4 also supported), spryker_orm Propel2, spryker_queue RabbitMQ, spryker_cache Redis / Valkey, spryker_search Elasticsearch, commercetools_api Composable Commerce HTTP + GraphQL API — continuously deployed SaaS with no platform version number; release notes checked through 2026-06/2026-07, commercetools_graphql_change GraphQL 'Set' scalar removed 2026-06-02 Prerequisites: - Familiarity with both PHP/Symfony suite-based commerce and API-first composable commerce, since the comparison assumes basic knowledge of both models - Access to Spryker's GitHub organisations (spryker, spryker-shop) to confirm current module count and the exact evaluation-licence text - Access to commercetools' Merchant Center or sales team to confirm current order/projection-quota pricing and Commerce MCP entitlements - A reading of Spryker's bundled evaluation licence and commercetools' Terms of Service, since the licence and quota details here are summarised, not reproduced in full Questions answered: - Is Spryker's GitHub-published code open source? — No. Spryker's 750+ modules are source-available under a licence that permits only a 45-calendar-day, non-production evaluation; production use of any kind requires a separate signed commercial agreement, which does not meet the OSI's open source definition of unrestricted production and commercial use. - Does Spryker's AI Dev SDK MCP server do the same job as commercetools' Commerce MCP? — No. Spryker's AI Dev SDK MCP server is a development-time tool that adds Spryker-context awareness to coding assistants such as a Claude Code plugin, CLI and LSP integration; it is separate from Spryker's own 'Commerce MCP Server' listing, whose runtime scope this research could not confirm. commercetools' Commerce MCP is a runtime, project-scoped agent interface for carts, orders, products and pricing — verify Spryker's Commerce MCP Server scope directly before assuming equivalence. Primary sources: - Spryker Documentation — Release notes 202606.0: https://docs.spryker.com/docs/about/all/releases/release-notes-202606.0.html - About Spryker | Spryker Documentation: https://docs.spryker.com/docs/about/all/about-spryker.html - spryker-shop/b2c-demo-shop — LICENSE: https://github.com/spryker-shop/b2c-demo-shop/blob/master/LICENSE - Spryker Cloud Commerce OS | Spryker PaaS+: https://spryker.com/platform/technologies/paas-plus-cloud-commerce - AI Dev SDK Overview | Spryker Documentation: https://docs.spryker.com/docs/dg/dev/ai/ai-dev/ai-dev-overview - Commerce MCP Server | Spryker Documentation: https://docs.spryker.com/docs/dg/dev/ai/ai-commerce/commerce-mcp-server/commerce-mcp-server.html - API Platform migration overview | Spryker Documentation: https://docs.spryker.com/docs/dg/dev/upgrade-and-migrate/migrate-to-api-platform-overview.html - Technology stack | Spryker Documentation: https://docs.spryker.com/docs/dg/dev/architecture/technology-stack.html - Supported versions of PHP | Spryker Documentation: https://docs.spryker.com/docs/dg/dev/supported-versions-of-php - MCP overview | commercetools Dev Tooling: https://docs.commercetools.com/dev-tooling/mcp/overview - Limits | commercetools HTTP API: https://docs.commercetools.com/api/limits - commercetools — Pricing: https://commercetools.com/pricing - What is Cloud-Native? | commercetools: https://commercetools.com/cloud-native - The Top 15 commercetools Customer Stories of 2025 (commercetools blog, 2025-12-10): https://commercetools.com/blog/top-commercetools-customer-stories - HTTP API Releases | commercetools: https://docs.commercetools.com/api/releases - commercetools Launches commercetools Foundry (press release): https://commercetools.com/press-releases/commercetools-launches-commercetools-foundry - commercetools/commerce-mcp — GitHub repository: https://github.com/commercetools/commerce-mcp --- ## Sylius in 2026: A Commerce Framework, Not a Ready-Made Store URL: https://codenx.com/ecommerce/sylius-review/ Type: tool-review · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-08-01 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Sylius is an MIT-licensed PHP/Symfony/API Platform framework, not a configurable packaged cart: the free Community Edition ships an admin panel and basic Twig storefront but models commerce in code, while B2B, RBAC, RFQ and marketplace features sit only behind Sylius Plus, priced from €800/year on gross merchandise volume. It fits Symfony-capable teams with non-standard business rules. Summary: Sylius's feature table hides where the free core stops and Sylius Plus's GMV pricing starts: verified module boundaries, architecture and a five-question PoC checklist. Tested with: sylius 2.2.7 (latest tagged release per GitHub Releases at time of research; re-verify exact date before publishing), sylius-plus commercial edition, module set current as of 2026-07, php-minimum 8.2 (extensions: gd, exif, fileinfo, intl, sodium), symfony-minimum ^7.2 (2.2.x line, raised from ^7.1), node ^20 || ^22, mysql 8.0+, mariadb 10.4.10+, postgresql 13.9+, mcp-server-plugin 0.2.0 (released 2026-02-23) Prerequisites: - Familiarity with the CodeNx ecommerce platform evaluation framework, including the modernity and AI/agent-readiness scoring rubric - A PHP 8.2+ environment with Symfony development experience if testing Sylius Community Edition directly (Node ^20 or ^22, and MySQL 8.0+/MariaDB 10.4.10+/PostgreSQL 13.9+) - Access to Sylius's current Plus pricing and module pages, since GMV-based pricing and edition boundaries are dated snapshots that move - Basic familiarity with Shopware or Magento Open Source as PHP mid-market alternatives, since the review assumes that comparison point Questions answered: - How does Sylius compare to Shopware or Magento Open Source for a mid-market store? — All three are free, self-hosted PHP/Symfony-adjacent cores with paid growth paths, but Sylius requires the most custom Symfony development since it is a framework rather than a configurable cart, Shopware gates native B2B behind a paid Evolve tier, and Magento Open Source ships more catalogue and B2B depth in its free core at a heavier implementation and infrastructure cost; a dedicated comparison is needed to verify current specifics on all three. Primary sources: - Sylius — official site: https://sylius.com/ - Sylius/Sylius — GitHub repository: https://github.com/Sylius/Sylius - Sylius docs — Before you begin (system requirements): https://docs.sylius.com/public/getting-started/before-you-begin.md - Releases · Sylius/Sylius: https://github.com/Sylius/Sylius/releases - Sylius Plus — pricing and modules: https://sylius.com/plus/ - Sylius/McpServerPlugin — GitHub repository: https://github.com/Sylius/McpServerPlugin - sylius/mcp-server-plugin — Packagist: https://packagist.org/packages/sylius/mcp-server-plugin - Sylius Addons Marketplace — MCP Server Plugin: https://store.sylius.com/products/mcp-serverplugin-by-sylius - Sylius — case studies: https://sylius.com/case-studies/ - w3techs — Usage Statistics and Market Share of Sylius, July 2026: https://w3techs.com/technologies/details/cm-sylius - Sylius/Sylius UPGRADE-2.1.md (2.2 branch): https://github.com/Sylius/Sylius/blob/2.2/UPGRADE-2.1.md - Latka — Sylius company profile (revenue, team size): https://getlatka.com/companies/sylius.com - "[RFC] Removing the sylius/theme-bundle from the admin package" · Issue #13143 · Sylius/Sylius: https://github.com/Sylius/Sylius/issues/13143 - Sylius Demo (official live demo storefront and admin): https://demo.sylius.com/en/ - Sylius blog — "What a Year it was! Let's summarize what happened in 2025": https://sylius.com/blog/what-a-year-it-was-2025/ --- ## Sylius vs Shopware vs Magento: Framework, Platform or Suite? URL: https://codenx.com/ecommerce/sylius-vs-shopware-vs-magento/ Type: comparison · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-08-01 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Sylius is an MIT-licensed Symfony framework with no commerce features beyond a basic storefront. Shopware is an MIT-licensed platform that gates B2B and AI tools behind paid tiers from €600 a month. Magento Open Source is free but keeps B2B and AI/MCP tooling in the separate, closed-source Adobe Commerce. Match the model to your Symfony capability, not a feature count. Summary: Sylius, Shopware and Magento solve commerce differently — framework, subscription platform and forked suite. Compare licence, pricing tiers and version floors, not checkmarks. Tested with: sylius 2.2.7, sylius-php-minimum 8.2, sylius-symfony-minimum ^7.2, sylius-node ^20 || ^22, sylius-database MySQL 8.0+ / MariaDB 10.4.10+ / PostgreSQL 13.9+, sylius-mcp-server-plugin guest-mode only, 14 tools (exact version number not reconfirmed on the current addons.sylius.com listing after a URL redirect), shopware 6.7.12.2, shopware-maintenance-line 6.6.10.21, shopware-php 8.2 and 8.4 tested at the 6.7.0.0 baseline; later 6.7.12.x notes also reference 8.5 without a confirmed minimum for that patch, shopware-database MySQL 8 or MariaDB 11, shopware-mcp-server experimental since 6.7.11.0, behind MCP_SERVER feature flag, magento-open-source 2.4.9, magento-php 8.4 or 8.5, magento-composer 2.10, magento-mysql 8.4, magento-mariadb 12.3, magento-opensearch 3 Prerequisites: - A test environment able to run PHP 8.2 or newer with Composer, Node ^20 or ^22, and one of MySQL 8.0+/MariaDB 10.4.10+/PostgreSQL 13.9+ for a Sylius 2.2.7 proof-of-concept install - PHP 8.2 or 8.4 and MySQL 8/MariaDB 11 available to install Shopware 6.7.12.2 for comparison, since the 6.7 line raises its PHPUnit and Doctrine DBAL floor over 6.6.x - PHP 8.4 or 8.5, Composer 2.10, MySQL 8.4 or MariaDB 12.3 and OpenSearch 3 available to install Magento Open Source 2.4.9 - Working familiarity with Symfony's dependency-injection and routing conventions, since Sylius is a Symfony application and Magento 2.4.9 now depends on Symfony 7.4 components internally - Confirmed current pricing for Sylius Plus, Shopware's Rise/Evolve/Beyond tiers and any Adobe Commerce quote before treating a figure in this comparison as final, since subscription and quote-based pricing changes without a version bump Questions answered: - Do Shopware and Magento also offer a headless or PWA storefront option? — Shopware ships a separate headless storefront package and Magento's headless path runs through its GraphQL API paired with a separate storefront solution; neither is covered in the version and pricing detail this comparison applies to Sylius, so confirm the current package name, licence and version of either directly before scoping a headless build. - Which platform costs the least once a B2B rollout is unavoidable? — It depends on GMV and team capacity more than sticker price: Sylius Plus's B2B Suite is priced from €800/year against store GMV, Shopware's B2B Components require at minimum the Evolve tier from €2,400/month, and Magento Open Source has no B2B price at all — the requirement forces a move to Adobe Commerce, a separate quote-based product. Price all three against your own GMV and roadmap before assuming any one is cheaper. Primary sources: - Sylius — official site: https://sylius.com/ - Sylius/Sylius — GitHub repository: https://github.com/Sylius/Sylius - Releases · Sylius/Sylius: https://github.com/Sylius/Sylius/releases - Sylius docs — Before you begin (system requirements): https://docs.sylius.com/public/getting-started/before-you-begin.md - Sylius Plus — pricing and modules: https://sylius.com/plus/ - Sylius/McpServerPlugin — GitHub repository: https://github.com/Sylius/McpServerPlugin - Sylius Addons Marketplace: https://addons.sylius.com/ - w3techs — Usage Statistics and Market Share of Sylius: https://w3techs.com/technologies/details/cm-sylius - Shopware — official site: https://www.shopware.com/ - Shopware — pricing: https://www.shopware.com/en/pricing/ - shopware/shopware — GitHub repository: https://github.com/shopware/shopware - Releases · shopware/shopware: https://github.com/shopware/shopware/releases - shopware/shopware — LICENSE: https://github.com/shopware/shopware/blob/trunk/LICENSE - Shopware developer docs — MCP server: https://developer.shopware.com/docs/products/tools/mcp-server/ - Shopware — Agentic Commerce product page: https://www.shopware.com/en/products/shopware-intelligence/agentic-commerce/ - w3techs — Usage Statistics and Market Share of Shopware: https://w3techs.com/technologies/details/cm-shopware - magento/magento2 — GitHub repository: https://github.com/magento/magento2 - magento/magento2 — LICENSE.txt: https://github.com/magento/magento2/blob/2.4-develop/LICENSE.txt - Adobe — Magento Open Source 2.4.9 release notes: https://experienceleague.adobe.com/en/docs/commerce-operations/release/notes/magento-open-source/2-4-9 - Adobe — Commerce system requirements: https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements - Adobe — B2B installation and supported platforms: https://experienceleague.adobe.com/en/docs/commerce-admin/b2b/install - Adobe — Security bulletin APSB26-73: https://helpx.adobe.com/security/products/magento/apsb26-73.html - Adobe Developer — Commerce AI/agent extensibility docs: https://developer.adobe.com/commerce/extensibility/developer-agent/ - w3techs — Usage Statistics and Market Share of Adobe Commerce (Magento): https://w3techs.com/technologies/details/cm-magento --- ## Vendure vs EverShop: Framework Depth or Faster Full-Stack Start? URL: https://codenx.com/ecommerce/vendure-vs-evershop/ Type: comparison · Difficulty: intermediate Published: 2026-07-28 Last verified: 2026-08-01 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Choose Vendure for framework depth: a GPLv3 headless commerce core with separate Server, Worker and Dashboard layers, dual GraphQL APIs, and B2B/multi-vendor building blocks gated behind a paid Platform tier. Choose EverShop for a faster full-stack start: one GPL-3.0 codebase with a working storefront, admin panel and API, no paid tier, on PostgreSQL 13+. Summary: Feature checklists show Vendure and EverShop as equals; license terms, storefront inclusion, admin UI maturity and B2B tier pricing show why they solve different jobs. Tested with: vendure_core 3.7.1 (@vendure/core, GPL-3.0-or-later, released 2026-07-14), vendure_dashboard React-based Dashboard current; Angular Admin UI unmaintained after July 2026, evershop 2.1.2 (GPL-3.0, released 2026-04-03), node_vendure v20, v22, v24 officially supported, node_evershop 20.x or higher required, npm_evershop 9.x or higher required, postgresql_evershop 13 or higher required, 15+ recommended, vendure_databases PostgreSQL, MySQL/MariaDB, or SQLite via TypeORM Prerequisites: - Node.js v20, v22 or v24 for Vendure Core 3.7.1; Node.js 20.x or higher and npm 9.x or higher for EverShop 2.1.2 - PostgreSQL 13+ available locally or via Docker (15+ recommended for EverShop); MySQL/MariaDB or SQLite as alternatives only apply to Vendure - Working knowledge of TypeScript and GraphQL - No prior CodeNx article required, but useful to have already scoped whether the project needs a headless storefront or a single deployable app Primary sources: - Discover Vendure's New Licensing Models: https://vendure.io/blog/license-change-announcement - @vendure/core package.json (version + license field): https://github.com/vendurehq/vendure/blob/master/packages/core/package.json - Vendure CHANGELOG.md (dated release history): https://github.com/vendurehq/vendure/blob/master/CHANGELOG.md - Vendure Pricing: https://vendure.io/pricing - Vendure Architecture Overview — Server, Worker, Dashboard, Storefront: https://docs.vendure.io/current/core/developer-guide/overview - Announcing our new Admin UI: A Move to React: https://vendure.io/blog/vendure-react-admin-ui - Migrating from Admin UI: https://docs.vendure.io/guides/extending-the-dashboard/migration/ - Storefront Starters: https://docs.vendure.io/guides/storefront/storefront-starters/ - Installing Vendure with @vendure/create: https://docs.vendure.io/guides/getting-started/installation/ - Multi-tenant Commerce with Vendure: https://vendure.io/blog/multi-tenant-commerce-with-vendure - B2B ecommerce platform: accounts and approvals: https://vendure.io/solutions/b2b-commerce - Vendure Plugins directory: https://docs.vendure.io/plugins - evershopcommerce/evershop GitHub repository: https://github.com/evershopcommerce/evershop - EverShop GitHub releases: https://github.com/evershopcommerce/evershop/releases - Architecture Deep Dive: The EverShop Platform: https://evershop.io/docs/development/knowledge-base/architecture-overview - EverShop System Requirements: https://evershop.io/docs/development/getting-started/system-requirements - EverShop GraphQL System: https://evershop.io/docs/development/knowledge-base/graphql - EverShop Events and Subscribers: https://evershop.io/docs/development/knowledge-base/events-and-subscribers - EverShop Pricing: https://evershop.io/pricing - EverShop: Open-Source Node.js & TypeScript Ecommerce Platform: https://evershop.io/docs/development/getting-started/introduction - Vendure Shop API Guide: https://docs.vendure.io/reference/graphql-api/shop/ --- ## Why Ecommerce Upgrades Fail: Core Changes, Plugins, Schemas and Search URL: https://codenx.com/ecommerce/ecommerce-upgrade-failures/ Type: explainer · Difficulty: intermediate Published: 2026-07-27 Last verified: 2026-07-28 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Ecommerce upgrades fail because plugins, database schemas and search indexes each carry independent compatibility contracts that don't move in step with the platform's core version number, so a safe-looking core release can still break checkout, admin controllers or catalogue search when an extension API, a schema migration or a search mapping changes without warning. Summary: Platform upgrades break checkout, admin panels or search not from the core version bump itself but from plugin, schema and search-index contracts moving on separate timelines. Tested with: Magento Open Source / Adobe Commerce 2.4.8, WordPress 6.9, WooCommerce 10.4.2, PrestaShop 9.0 (migrating from 8.x), Symfony 6.4 LTS (PrestaShop 9.0's underlying framework, up from 4.4 in 8.x), Shopware 6.7 (migrating from 6.6), PostgreSQL 18 (ADD COLUMN metadata-only fast path present since PostgreSQL 11), OpenSearch 2.x/3.x — verify exact target version before publication, Semantic Versioning 2.0.0 Prerequisites: - Admin or SSH access to a staging copy of the store running the versions in scope: Magento/Adobe Commerce 2.4.8, WordPress 6.9, WooCommerce 10.4.2, PrestaShop 9.0 or Shopware 6.7 - A recent full backup of the database and files, with a tested rollback path - Basic familiarity with reading a platform's own changelog or upgrade guide before running an upgrade - Enough SQL familiarity to read a lock-wait or pg_locks query if evaluating the PostgreSQL section - For the search sections, an existing Elasticsearch or OpenSearch index to reason about, or willingness to follow the reasoning without one Questions answered: - Do headless or GraphQL-based commerce platforms have fewer upgrade failures? — The three contracts still exist — a headless platform just moves the plugin-contract risk into API versioning and client SDK compatibility instead of server-rendered hooks. Whether that produces fewer failures in practice needs direct verification per platform; this article did not test a headless upgrade path. - What counts as a breaking change in a database migration? — Any change that requires a full table rewrite, blocks reads or writes for more than a brief metadata update, or changes what an existing column's stored value means without a compatible transition path for rows already in the table. Primary sources: - Best practices for upgrading your project | Adobe Commerce: https://experienceleague.adobe.com/en/docs/commerce-on-cloud/user-guide/develop/upgrade/best-practices - Magento Open Source 2.4.8 release notes | Adobe Commerce: https://experienceleague.adobe.com/en/docs/commerce-operations/release/notes/magento-open-source/2-4-8 - Deprecation in core | WooCommerce developer docs: https://developer.woocommerce.com/docs/contribution/contributing/deprecation-in-core/ - Changes in PrestaShop 9.0.x | PrestaShop Developer Documentation: https://devdocs.prestashop-project.org/9/modules/core-updates/9.0/ - Version Upgrades and Migrations | Shopware Documentation: https://developer.shopware.com/docs/guides/upgrades-migrations/ - Backward Compatibility | Shopware Documentation: https://developer.shopware.com/docs/resources/guidelines/code/backward-compatibility.html - Breaking changes | OpenSearch Documentation: https://docs.opensearch.org/latest/breaking-changes/ - Migrate or upgrade OpenSearch | OpenSearch Documentation: https://docs.opensearch.org/latest/upgrade-or-migrate/ - Mapping | Elastic Docs: https://www.elastic.co/docs/manage-data/data-store/mapping - Semantic Versioning 2.0.0: https://semver.org/ - Our Backward Compatibility Promise | Symfony Docs: https://symfony.com/doc/current/contributing/code/bc.html - WordPress 6.9 Field Guide | Make WordPress Core: https://make.wordpress.org/core/2025/11/25/wordpress-6-9-field-guide/ - Abilities API in WordPress 6.9 | Make WordPress Core: https://make.wordpress.org/core/2025/11/10/abilities-api-in-wordpress-6-9/ - WordPress 6.9 Broke 3 Popular Plugins: Fixes and Safe Update Guide | 365i: https://www.365i.co.uk/news/2025/12/02/wordpress-6-9-broke-3-plugins-fix/ - ALTER TABLE | PostgreSQL Documentation: https://www.postgresql.org/docs/current/sql-altertable.html - Expand/Contract: making a breaking change without a big bang | Pete Hodgson: https://blog.thepete.net/blog/2023/12/05/expand/contract-making-a-breaking-change-without-a-big-bang/ - Schema Deprecations | Apollo GraphQL Docs: https://www.apollographql.com/docs/graphos/schema-design/guides/deprecations --- ## EverShop in 2026: A Coherent TypeScript Store with a Young Ecosystem URL: https://codenx.com/ecommerce/evershop-review/ Type: tool-review · Difficulty: intermediate Published: 2026-07-27 Last verified: 2026-07-28 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: EverShop is a GPL-3.0 Node.js/TypeScript/React/PostgreSQL modular monolith that suits small JavaScript teams who want one deployable app with a working default storefront and admin. It is not yet a fit for teams needing multi-vendor, B2B, or role-scoped admin access: its extensions marketplace is small and free-only, its REST API has only a public/private access flag, and admin role management has been an open GitHub issue since October 2023. Summary: Does EverShop's single-language stack offset its small ecosystem? Verified pricing, architecture trade-offs, scoring and a five-question PoC checklist. Tested with: evershop 2.1.2 (latest GitHub release as of this research pass, published 2026-04-03; confirm no newer patch/minor before publication), node 20.x or higher (documented minimum; versions below 20.x are unsupported), npm 9.x or higher, postgresql 13 minimum, 15+ recommended, npm-package @evershop/evershop Prerequisites: - Node.js 20.x or higher and npm 9.x or higher installed — EverShop 2.1.2's documented minimum; versions below 20.x are explicitly unsupported - A PostgreSQL instance you control, version 13 minimum with 15+ recommended, since EverShop bundles no database of its own - Working knowledge of Express-style Node.js and server-rendered React, since EverShop's codebase combines both in a single repository - Familiarity with the CodeNx ecommerce platform series methodology — its modernity and AI/agent-readiness rubrics, evidence-box format, and proof-of-concept checklist convention, which this review applies rather than re-explains Questions answered: - Is EverShop or Vendure the better choice for a TypeScript-first team? — They solve different problems: EverShop is a full-stack modular monolith with a bundled storefront and admin, while Vendure is a headless framework you build a storefront on top of. Which is 'better' depends on whether you want a working default store immediately or need headless flexibility with a more mature plugin and permissions model — a dedicated comparison against the current editions is needed before recommending one over the other. Primary sources: - EverShop — official site: https://evershop.io/ - EverShop GitHub repository: https://github.com/evershopcommerce/evershop - EverShop GitHub releases: https://github.com/evershopcommerce/evershop/releases - EverShop LICENSE (GPL-3.0): https://github.com/evershopcommerce/evershop/blob/main/LICENSE - EverShop — System Requirements: https://evershop.io/docs/development/getting-started/system-requirements - EverShop — Architecture Deep Dive: https://evershop.io/docs/development/knowledge-base/architecture-overview - EverShop — API Overview: https://evershop.io/docs/api/overview - EverShop — RESTful API Routes: https://evershop.io/docs/development/knowledge-base/api-routes - EverShop — Events and Subscribers: https://evershop.io/docs/development/knowledge-base/events-and-subscribers - EverShop — GraphQL System: https://evershop.io/docs/development/knowledge-base/graphql - EverShop Marketplace (extensions): https://evershop.io/extensions - EverShop — Pricing: https://evershop.io/pricing - EverShop — Installation Guide: https://evershop.io/docs/development/getting-started/installation-guide - GitHub issue #359 — Admin user/role management: https://github.com/evershopcommerce/evershop/issues/359 - npm registry download-count API — @evershop/evershop, last week: https://api.npmjs.org/downloads/point/last-week/@evershop/evershop --- ## Headless Commerce Failure Modes: CMS, Search, Checkout and Preview Gaps URL: https://codenx.com/ecommerce/headless-commerce-failure-modes/ Type: explainer · Difficulty: intermediate Published: 2026-07-27 Last verified: 2026-07-28 Author: swadesh Topics: ecommerce Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Headless commerce fails when nobody owns the seams between vendors: stale CMS previews, search indexes lagging catalogue updates, checkout pages gated by plan tier or reclassified into a larger PCI scope, and unreplayed webhooks causing duplicate charges. Each failure traces to a documented vendor limit, not platform quality — test the seam before launch, not after. Summary: Why decoupling a storefront into CMS, search and checkout vendors multiplies preview gaps, stale search results, PCI scope creep and webhook duplication — and how to test for each before launch. Tested with: Next.js 16.2.12, Vendure Core 3.7.1, Saleor Core 3.23.22, PCI DSS 4.0.1, Shopify Checkout Extensibility no single version number published — Shopify Plus gating on information/shipping/payment extension points confirmed against shopify.dev on 2026-07-27; reconfirm at publication Prerequisites: - A chosen CMS with a documented preview mechanism (examples in this article use Next.js 16.2.12 Draft Mode and Contentful's Preview API) - A storefront built against at least one commerce engine — Vendure Core 3.7.1, Saleor Core 3.23.22, Shopify Hydrogen, or commercetools — with admin access to inspect its checkout integration mode - Knowledge of the merchant account's current PCI SAQ classification (A or A-EP) before evaluating checkout customisation - Read access to webhook delivery logs (Stripe or an equivalent processor) to inspect retry counts and event IDs - Basic familiarity with CDN/ISR caching and asynchronous queue-based reindexing, since both concepts are assumed rather than re-taught Questions answered: - What is the difference between headless commerce and composable commerce? — Headless commerce specifically means decoupling the storefront front end from the commerce back end via APIs; composable commerce is the broader MACH-derived practice of assembling best-of-breed CMS, search, checkout and commerce vendors independently, of which headless is one required property, not a synonym. Primary sources: - standards/reference/architecture-explained.md — MACH Alliance: https://github.com/machalliance/standards/blob/main/reference/architecture-explained.md - MACH Principles | MACH Alliance: https://machalliance.org/mach-principles - Content Preview API Overview | Contentful Docs: https://www.contentful.com/developers/docs/references/content-preview-api/overview/ - Guides: Draft Mode | Next.js Docs: https://nextjs.org/docs/app/guides/draft-mode - Visual Editor | Storyblok Documentation: https://www.storyblok.com/docs/concepts/visual-editor - Checkout overview | commercetools Composable Commerce Docs: https://docs.commercetools.com/checkout/overview - Using Payment Apps | Saleor Commerce Documentation: https://docs.saleor.io/developer/payments/payment-apps - Storefront Checkout Flow with the Vendure Shop API | Vendure Docs: https://docs.vendure.io/guides/storefront/checkout-flow/ - About checkout app extensions | Shopify.dev: https://shopify.dev/docs/api/checkout-extensions - Webhooks | Stripe Docs: https://docs.stripe.com/webhooks - Just Published: PCI DSS v4.0.1 | PCI Security Standards Council Blog: https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1 - Self-Assessment Questionnaire A (PCI DSS v4.0) | PCI Security Standards Council: https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-A.pdf - Understand JavaScript SEO Basics | Google Search Central Documentation: https://developers.google.com/search/docs/crawling-indexing/javascript/javascript-seo-basics - Backends for Frontends pattern | Azure Architecture Center, Microsoft Learn: https://learn.microsoft.com/en-us/azure/architecture/patterns/backends-for-frontends - Integrating with Algolia | Elastic Path Documentation: https://developer.elasticpath.com/docs/composer/integration-hub/site-search/algolia - Distributed Orchestration | Apollo GraphQL Docs: https://www.apollographql.com/docs/graphos/schema-design/guides/distributed-orchestration - Merchants — PCI Security Standards Council: https://www.pcisecuritystandards.org/merchants/ - saleor/saleor Releases | GitHub: https://github.com/saleor/saleor/releases - @vendure/core | npm: https://www.npmjs.com/package/@vendure/core --- ## How to Run PostgreSQL Securely on a VPS URL: https://codenx.com/postgresql/postgresql-secure-vps/ Type: deployment-guide · Difficulty: advanced Published: 2026-07-23 Last verified: 2026-07-23 Author: swadesh Topics: postgresql, databases, vps, security Direct answer: Leave `listen_addresses` on `localhost` unless a remote host genuinely needs access, and then bind only to the private interface. Use `scram-sha-256` in `pg_hba.conf`, require `hostssl` for anything not on loopback, and give the application a `LOGIN` role with `CONNECT`, `USAGE` and table privileges only — never the database owner and never a superuser. Add `statement_timeout` and `idle_in_transaction_session_timeout` so one stuck client cannot hold locks indefinitely. Summary: Keep the listener off the public internet, get pg_hba.conf right, require TLS for remote connections, and give the application a role that cannot drop your tables — on PostgreSQL 17 and Ubuntu 24.04. Tested with: operatingSystem Ubuntu 24.04 LTS, postgresql 17.5, PGDG apt packages, psql 17.5, openssl 3.0.13 Prerequisites: - An Ubuntu 24.04 VPS with sudo access - PostgreSQL 17 installed from the PGDG repository - An application that connects with a connection string you control Questions answered: - Should PostgreSQL ever listen on a public IP address? — Almost never. Bind to `localhost` for a same-host application, or to the private network interface when another server needs it. If a remote client genuinely must connect over the internet, put it behind a VPN or an SSH tunnel rather than opening 5432. - What is the difference between host and hostssl in pg_hba.conf? — `host` matches both encrypted and unencrypted TCP connections; `hostssl` matches only TLS ones. Use `hostssl` for every non-loopback rule so a client cannot negotiate down to plaintext. - Why does my app get permission denied on tables created after setup? — `GRANT ... ON ALL TABLES` applies only to tables that existed at that moment. Use `ALTER DEFAULT PRIVILEGES` so future tables created by the owner role inherit the grants automatically. - Is a superuser role ever acceptable for an application? — No. A superuser bypasses every permission check, can read arbitrary files through server-side COPY, and can install extensions. Application code needs none of that, and a SQL injection in a superuser session is a host compromise rather than a data leak. - Do I need a certificate from a public CA for PostgreSQL TLS? — Not if you control both ends. A self-signed certificate with clients configured for `sslmode=verify-full` and the CA certificate distributed to them gives you encryption plus server authentication, which is what matters here. Primary sources: - The pg_hba.conf file: https://www.postgresql.org/docs/current/auth-pg-hba-conf.html - Secure TCP/IP connections with SSL: https://www.postgresql.org/docs/current/ssl-tcp.html - GRANT: https://www.postgresql.org/docs/current/sql-grant.html - ALTER DEFAULT PRIVILEGES: https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html - Client connection defaults: https://www.postgresql.org/docs/current/runtime-config-client.html --- ## How to Build a GitHub Actions Deployment Pipeline URL: https://codenx.com/github-actions/github-actions-deployment-pipeline/ Type: tutorial · Difficulty: intermediate Published: 2026-07-01 Last verified: 2026-07-16 Author: swadesh Topics: github-actions, devops, docker Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Split the workflow into three jobs — test, build-and-push, deploy — chained with `needs`. Build the image once and tag it with the commit SHA, push it to GHCR using the built-in `GITHUB_TOKEN` with `packages: write`, then deploy by SSHing to the host and running `docker compose up -d --wait` against that tag. Add a `concurrency` group so two deploys cannot overlap, and put the deploy job in a GitHub Environment so the production credentials are not readable from every other job. Summary: Test, build a container image, push it to GHCR and deploy it to a VPS over SSH — with the concurrency guard, environment approval and token scoping that keep the pipeline from becoming the weak point. Tested with: runner ubuntu-24.04 GitHub-hosted, docker 27.x on the target host, registry ghcr.io, bun 1.3.9, target Ubuntu 24.04 LTS VPS Prerequisites: - A repository with a Dockerfile that builds locally - A VPS running Docker, reachable over SSH - Permission to add repository secrets and environments Questions answered: - Should I build the image in CI or on the server? — In CI. Building on the target host consumes the memory and CPU your application needs, and it means the artifact that ships was never tested — you tested a different build. Build once, tag by commit SHA, deploy that exact tag. - Why tag images with the commit SHA instead of latest? — Because `latest` is not a version. With a SHA tag you can say exactly what is running, roll back by redeploying a previous tag, and reproduce a report against the same image. Push `latest` as well if you like, but deploy the SHA. - Is SSHing from a GitHub runner safe? — It is acceptable with a dedicated deploy key restricted by `command=` in `authorized_keys`, a `known_hosts` entry so the host is verified, and the key stored in an environment secret rather than a repository secret. A pull-based deploy where the server polls the registry avoids inbound access entirely and is stronger if you can arrange it. - How do I stop two deploys running at once? — A `concurrency` group at the workflow level with `cancel-in-progress: false`. The second run queues until the first finishes, rather than both writing to the host simultaneously. - Do I need to pin third-party actions to a commit SHA? — For anything outside your own organisation, yes. A tag is mutable — the author can move `v3` to new code at any time, and that code runs with access to your secrets. Pin the SHA and let Dependabot bump it. Primary sources: - GitHub Actions documentation: https://docs.github.com/en/actions - Workflow syntax for GitHub Actions: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions - Security hardening for GitHub Actions: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions - Introduction to GitHub Actions with Docker: https://docs.docker.com/build/ci/github-actions/ - docker/build-push-action: https://github.com/docker/build-push-action --- ## How to Run Meilisearch in Production with Docker URL: https://codenx.com/meilisearch/meilisearch-production-setup/ Type: deployment-guide · Difficulty: intermediate Published: 2026-06-17 Last verified: 2026-07-15 Author: swadesh Topics: meilisearch, databases, docker, security Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Run `getmeili/meilisearch` pinned to a v1 minor with `MEILI_ENV=production` and a master key of at least 16 bytes, bind it to `127.0.0.1` behind your existing reverse proxy, and never send the master key to a browser — create a search-only API key scoped to one index for client code. Set `searchableAttributes` and `filterableAttributes` before you load documents, because changing them afterwards triggers a full reindex. Summary: A Meilisearch deployment that survives a real workload — master key handling, scoped API keys, the index settings you must set before loading data, snapshots, and what its memory usage actually means. Tested with: operatingSystem Ubuntu 24.04 LTS, docker 27.x, meilisearch v1.13, server 2 vCPU / 4 GB RAM, documents ~120,000 indexed documents Prerequisites: - A Docker host with at least 2 GB RAM free - A reverse proxy already terminating TLS - Documents with a stable, unique id field Questions answered: - Why is Meilisearch using so much memory? — It memory-maps its database, so resident memory tracks how much of the index the kernel has paged in. That memory is reclaimable page cache, not an allocation, and a high RSS on an otherwise idle host is expected. Watch search latency and swap activity instead. - Can I expose Meilisearch directly to the browser? — Only through a search-only API key scoped to the indexes that should be public. Never the master key or an admin key — those allow document writes and key creation. Use tenant tokens if different users must see different subsets of one index. - What happens if I change searchableAttributes after loading data? — Meilisearch reindexes every document in that index. On a large index that is minutes of elevated CPU and disk during which search still works but results reflect the old settings until the task completes. - Snapshots or dumps for backups? — Snapshots for fast recovery on the same version — they are a binary copy and restore quickly. Dumps for version upgrades and migrations, because they are version-independent but much slower to import. - Do I need to stop Meilisearch to upgrade it? — Yes, briefly. Take a dump, stop the container, change the image tag, start it with the dump import, and verify. Read the release notes for the versions you are skipping — Meilisearch occasionally changes the database format between minors. Primary sources: - Install Meilisearch: https://www.meilisearch.com/docs/learn/self_hosted/install_meilisearch_locally - Configure Meilisearch at launch: https://www.meilisearch.com/docs/learn/self_hosted/configure_meilisearch_at_launch - Keys API reference: https://www.meilisearch.com/docs/reference/api/keys - Settings API reference: https://www.meilisearch.com/docs/reference/api/settings - Tasks API reference: https://www.meilisearch.com/docs/reference/api/tasks --- ## An AI Coding Agent Workflow That Keeps Diffs Reviewable URL: https://codenx.com/ai-agents/ai-coding-agent-workflow/ Type: workflow-guide · Difficulty: intermediate Published: 2026-06-03 Last verified: 2026-07-10 Author: swadesh Topics: ai-agents, ai-coding, claude-code, ai Direct answer: Scope each agent session to one commit's worth of work, isolate it in its own branch or git worktree, express the task as a failing test rather than a paragraph of prose, and review the resulting diff line by line before merging. The constraint that matters is session size — an agent that has been running for two hours has produced a change nobody will read carefully, and unreviewed code is the actual risk, not wrong code. Summary: A working loop for running a coding agent on a real codebase — task scoping, branch isolation, tests as the contract, and the review discipline that stops unreviewed code reaching main. Tested with: claudeCode 2.x, git 2.45, node 22.12.0 LTS, repositorySize ~40k lines TypeScript Prerequisites: - A repository with a test suite that runs in under two minutes - A coding agent CLI already installed and authenticated - Comfort reading git diffs Questions answered: - How large a task should one agent session handle? — One commit. If the change would need more than about 300 changed lines or touches more than a handful of files, split it. The limit is not what the agent can do — it is what you will actually read before approving. - Should agent-authored commits be labelled as such? — Yes, in the commit trailer or the pull request body. It costs nothing and it tells the next person reading `git blame` how much weight to give the original intent. It does not remove the reviewer's responsibility. - Do tests written by the agent count as verification? — Only if you read them. An agent asked to make tests pass can weaken the assertions instead of fixing the code. Write the acceptance test yourself, or read every test change in the diff. - Is it worth running several agent sessions in parallel? — Sometimes, using separate git worktrees so they do not share an index. The bottleneck moves to your review capacity almost immediately, so two concurrent sessions is usually the practical ceiling for one person. - When should I not use an agent at all? — Anything where the hard part is deciding what to build, anything touching authentication, payments or migrations, and anything in a part of the codebase you do not understand well enough to review a change to. Primary sources: - Claude Code overview: https://docs.claude.com/en/docs/claude-code/overview - Claude Code subagents: https://docs.claude.com/en/docs/claude-code/sub-agents - git-worktree: https://git-scm.com/docs/git-worktree - About protected branches: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches --- ## How to Use Claude Code on an Existing TypeScript Project URL: https://codenx.com/claude-code/claude-code-existing-typescript-project/ Type: tutorial · Difficulty: intermediate Published: 2026-05-12 Updated: 2026-07-02 Last verified: 2026-07-02 Author: swadesh Topics: claude-code, ai-coding, typescript, ai Direct answer: Install Claude Code with `npm install -g @anthropic-ai/claude-code`, run `claude` in the repo root, and use `/init` to generate a CLAUDE.md. Then edit that file so it describes your real build, test and lint commands, add a `.claude/settings.json` with an explicit permission allow list, and wire a PostToolUse hook that runs your typechecker after every edit. No migration or restructuring of the repo is needed. Summary: Add Claude Code to a TypeScript repo you already have: a CLAUDE.md that matches your real build, permission rules that block dangerous commands, and a typecheck loop the agent runs itself. Tested with: claudeCode 2.x, node 22.12.0 LTS, typescript 5.9, bun 1.3, operatingSystem Ubuntu 24.04 LTS and macOS 15 Prerequisites: - A TypeScript repository that builds locally today - Node.js 22 or newer, or Bun 1.2 or newer - Git, with a clean working tree before you start Questions answered: - Does Claude Code need the whole repository in context? — No. It reads files on demand through search and read tools rather than loading the tree up front. What is always in context is your CLAUDE.md, so keep that file short and factual — under roughly 200 lines — and let the agent discover everything else. - Should CLAUDE.md be committed to git? — Yes. CLAUDE.md is shared project knowledge and belongs in version control next to the code it describes. Keep personal overrides in `.claude/settings.local.json`, which should be gitignored. - Can I stop the agent from touching generated or vendored code? — Add deny rules for those paths in `.claude/settings.json`, for example `Edit(./dist/**)` and `Edit(./node_modules/**)`, and state the same rule in CLAUDE.md so the agent does not waste turns trying. - Why does the agent keep asking to run the same command? — The command does not match any allow rule. Run `/permissions` inside the session to see the active rules, then add a prefix rule such as `Bash(bun test:*)` so the whole family of commands is pre-approved. Primary sources: - Claude Code overview: https://docs.claude.com/en/docs/claude-code/overview - Manage Claude's memory (CLAUDE.md): https://docs.claude.com/en/docs/claude-code/memory - Claude Code settings and permissions: https://docs.claude.com/en/docs/claude-code/settings - Claude Code hooks: https://docs.claude.com/en/docs/claude-code/hooks - tsc CLI options: https://www.typescriptlang.org/docs/handbook/compiler-options.html --- ## How to Run Cloudflare Tunnel in Front of Traefik URL: https://codenx.com/traefik/cloudflare-tunnel-traefik/ Type: tutorial · Difficulty: advanced Published: 2026-05-05 Last verified: 2026-06-26 Author: swadesh Topics: traefik, cloudflare, docker, security Direct answer: Run `cloudflared` as a container on the same Docker network as Traefik, point the tunnel's public hostname at `http://traefik:80`, and let Traefik route by Host header to your services. Cloudflare terminates TLS at the edge, so Traefik only needs a plain HTTP entrypoint — but it must trust `X-Forwarded-*` headers from the cloudflared container or your application will see the wrong scheme and client IP. No inbound port needs to be open on the host. Summary: Expose Docker services through Cloudflare with no inbound ports open — cloudflared plus Traefik, the forwarded-header setting that trips people up, and how to verify the firewall is closed. Tested with: operatingSystem Ubuntu 24.04 LTS, docker 27.x, dockerCompose v2.29, cloudflared 2026.6.x, traefik v3.3 Prerequisites: - A domain already active on Cloudflare - Docker and Docker Compose on the host - Basic familiarity with Traefik routers and labels Questions answered: - Do I still need ports 80 and 443 open on the server? — No. cloudflared makes outbound connections to Cloudflare and traffic arrives back down those. A tunnelled host can run with every inbound port closed except SSH, and you can move SSH into the tunnel too. - Why does my application think every request is HTTP, not HTTPS? — Traefik is discarding `X-Forwarded-Proto` because the cloudflared container's IP is not in the entrypoint's `forwardedHeaders.trustedIPs` list. Add the Docker network subnet. - Can I use Cloudflare Tunnel with Let's Encrypt in Traefik? — You can, but there is little reason to. Cloudflare terminates TLS at the edge and the hop to your origin is inside the tunnel. Serving plain HTTP on an internal-only entrypoint keeps the config smaller and removes the ACME challenge problem you would otherwise have with no open ports. - What does Error 1033 mean? — Cloudflare has a DNS record for the hostname pointing at a tunnel, but no connector is currently registered for it. Either cloudflared is not running, or it is running with a token for a different tunnel. - How many cloudflared replicas should I run? — Two, on different hosts, once the service matters. Multiple connectors on the same tunnel are load balanced automatically, so a second replica removes cloudflared as a single point of failure without any extra config. Primary sources: - Create a remotely-managed tunnel: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/ - Cloudflare Tunnel origin configuration: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/ - Traefik Docker provider: https://doc.traefik.io/traefik/providers/docker/ - Traefik entrypoints — forwarded headers: https://doc.traefik.io/traefik/routing/entrypoints/ - Cloudflare Access policies: https://developers.cloudflare.com/cloudflare-one/policies/access/ --- ## Zero-Downtime Deploys in Dokploy with Docker Health Checks URL: https://codenx.com/dokploy/dokploy-zero-downtime-health-checks/ Type: configuration-guide · Difficulty: advanced Published: 2026-04-21 Last verified: 2026-06-12 Author: swadesh Topics: dokploy, docker, traefik, devops Direct answer: Give the container a `HEALTHCHECK` that hits a readiness endpoint, then set `deploy.update_config` with `order: start-first`, `parallelism: 1`, `failure_action: rollback` and a `monitor` window longer than the app's startup time. Swarm then starts the new task, waits for it to report healthy, shifts traffic and only afterwards stops the old task. Without a health check Swarm treats "process started" as healthy and you drop requests during every deploy. Summary: Dokploy runs apps as Docker Swarm services, so rolling updates are already there — they just need a real health check and an update policy. Plus how to prove no request was dropped. Tested with: operatingSystem Ubuntu 24.04 LTS, docker 27.x, Swarm mode active, dokploy v0.x, June 2026, traefik 3.x, application Node.js 22 HTTP service Prerequisites: - A Dokploy installation with at least one deployed application - An HTTP endpoint in your app that reports readiness - Comfort with docker service commands on the host Questions answered: - Why does Dokploy still drop requests during a deploy? — The service has no health check, so Swarm considers the task healthy the moment the process starts. It shifts traffic to a container that is still booting, and those requests fail. Add a `HEALTHCHECK` and the ordering problem disappears. - What is the difference between order start-first and stop-first? — `start-first` brings the new task up before removing the old one, so both run briefly. `stop-first` removes the old task first, which guarantees only one version is live but creates a gap. Use `start-first` unless two versions genuinely cannot coexist. - Can I do zero-downtime deploys with one replica? — Yes, with `order: start-first`. Swarm temporarily runs two tasks even though `replicas: 1`, then converges. You need enough memory on the node for both, and no host-mode published port. - Should the health endpoint check the database? — Not in the container health check. If the database has a hiccup, a dependency-checking health endpoint marks every replica unhealthy at once and turns a slow query into an outage. Check the process, and monitor dependencies separately. - How do I roll back a bad deploy in Dokploy? — Set `failure_action: rollback` so Swarm does it automatically when the new tasks fail their monitor window. To roll back manually, run `docker service rollback ` on the host, then redeploy the known good image tag from the UI. Primary sources: - Swarm service rolling updates: https://docs.docker.com/engine/swarm/swarm-tutorial/rolling-update/ - Compose deploy specification: https://docs.docker.com/reference/compose-file/deploy/ - Dockerfile HEALTHCHECK instruction: https://docs.docker.com/reference/dockerfile/#healthcheck - Traefik Docker Swarm provider: https://doc.traefik.io/traefik/providers/swarm/ - Dokploy documentation: https://docs.dokploy.com/docs/core --- ## How to Deploy an Astro Site to Cloudflare Workers URL: https://codenx.com/astro/deploy-astro-cloudflare-workers/ Type: deployment-guide · Difficulty: intermediate Published: 2026-04-09 Updated: 2026-07-14 Last verified: 2026-07-14 Author: swadesh Topics: astro, cloudflare-workers, cloudflare, typescript Direct answer: For a fully static Astro site, build with `astro build` and deploy the `dist` directory as Workers static assets — no adapter is needed. For server-rendered routes, install `@astrojs/cloudflare`, set `output: 'server'`, point `wrangler.jsonc` at `./dist/_worker.js/index.js` with the `dist` directory as the assets binding, and add the `nodejs_compat` compatibility flag. Deploy with `wrangler deploy`. Summary: Ship a static or server-rendered Astro site to Cloudflare Workers with Wrangler — adapter setup, wrangler.jsonc, nodejs_compat, secrets, custom domains and the errors you hit on the first deploy. Tested with: astro 7.1, adapter @astrojs/cloudflare, Astro 7 compatible release, wrangler 4.x, node 22.12.0 LTS, packageManager bun 1.3 Prerequisites: - An Astro project that builds locally with a working `astro build` - A Cloudflare account (the free plan is enough) - Node.js 22 or Bun 1.2+ Questions answered: - Do I need the Cloudflare adapter for a fully static Astro site? — No. If every route prerenders, `dist` is just files and you can serve them as Workers static assets with no Worker script at all. Add the adapter only when you need server-rendered routes, endpoints or middleware at request time. - Workers or Pages for a new Astro project? — Workers. Cloudflare now positions Workers with static assets as the default for new projects, and it is where new platform features land. Existing Pages deployments keep working, so there is no urgency to move a site that is already live. - Why does my build fail with "No such module node:buffer"? — The Workers runtime only exposes Node built-ins when the `nodejs_compat` compatibility flag is set and the compatibility date is recent enough. Add the flag in `wrangler.jsonc` and redeploy. - How do I read environment variables inside an Astro route on Workers? — Through `Astro.locals.runtime.env`, which the Cloudflare adapter populates with your vars, secrets and bindings. `import.meta.env` still works for values inlined at build time, but secrets are not available there. - Can I roll back a bad deploy? — Yes. `wrangler deployments list` shows recent versions and `wrangler rollback` restores a previous one. Note the version id printed by each deploy so you know what you are rolling back to. Primary sources: - Deploy your Astro site to Cloudflare: https://docs.astro.build/en/guides/deploy/cloudflare/ - Cloudflare adapter reference: https://docs.astro.build/en/guides/integrations-guide/cloudflare/ - Workers static assets: https://developers.cloudflare.com/workers/static-assets/ - Wrangler configuration: https://developers.cloudflare.com/workers/wrangler/configuration/ - Node.js compatibility for Workers: https://developers.cloudflare.com/workers/runtime-apis/nodejs/ --- ## How to Back Up Docker Volumes Automatically URL: https://codenx.com/docker/backup-docker-volumes-automatically/ Type: tutorial · Difficulty: intermediate Published: 2026-04-02 Updated: 2026-07-06 Last verified: 2026-07-06 Author: swadesh Topics: docker, vps, postgresql, devops Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Do not tar a running database's data directory — dump it with the database's own tool first. Back up plain file volumes with restic into an S3-compatible bucket, run both from one script on a systemd timer with `Persistent=true`, and restore a snapshot into a scratch container once a month. A backup you have never restored is an assumption, not a backup. Summary: A nightly backup for a self-hosted Docker host: database dumps taken with the right tools, file volumes snapshotted with restic, a systemd timer to run it, and a restore test that proves it works. Tested with: operatingSystem Ubuntu 24.04 LTS, docker 27.x, restic 0.17, postgresql 17, systemd 255 Prerequisites: - A Docker host with named volumes you care about - An S3-compatible bucket or another offsite target - sudo access to create systemd units Questions answered: - Can I just tar the Docker volume directory while the container runs? — For static files, yes. For a database, no. A tar of a live PostgreSQL or MySQL data directory captures pages mid-write and usually restores into a corrupt cluster. Use `pg_dump` or `mysqldump`, or stop the container first. - Where does Docker actually store named volumes? — Under `/var/lib/docker/volumes//_data` on Linux. You can back that path up directly, but running a helper container that mounts the volume is more portable and does not depend on Docker's internal layout. - How often should backups run? — Work backwards from how much data you can afford to lose. Nightly means up to 24 hours of loss. If that is too much, run database dumps every few hours — they are cheap — and keep the file-volume snapshot nightly. - Do I need restic, or is rsync enough? — rsync gives you a mirror, which means a deletion or an encryption event propagates to your only copy on the next run. restic keeps immutable, deduplicated, encrypted snapshots with retention, which is what you want for a backup as opposed to a mirror. - How do I know the backup ran last night? — Check `systemctl list-timers` for the last trigger and `journalctl -u docker-backup.service --since yesterday` for the exit status. Better, have the script emit a heartbeat to an external monitor so a host that is off does not silently stop reporting. Primary sources: - Back up, restore, or migrate data volumes: https://docs.docker.com/engine/storage/volumes/#back-up-restore-or-migrate-data-volumes - restic documentation: https://restic.readthedocs.io/en/stable/ - pg_dump: https://www.postgresql.org/docs/current/app-pgdump.html - systemd.timer: https://www.freedesktop.org/software/systemd/man/latest/systemd.timer.html --- ## Dokploy vs Coolify: Choosing a Self-Hosting Platform URL: https://codenx.com/dokploy/dokploy-vs-coolify-self-hosting/ Type: comparison · Difficulty: intermediate Published: 2026-03-24 Updated: 2026-07-22 Last verified: 2026-07-22 Author: swadesh Topics: dokploy, coolify, docker, vps Note: drafted with AI assistance, fact-checked and reviewed by a human editor. Direct answer: Pick Dokploy if you want rolling, zero-downtime deploys and multi-node scheduling out of the box — it runs applications as Docker Swarm services behind Traefik. Pick Coolify if you want the widest catalogue of one-click services, a larger community and a plain-Docker model that is easier to reason about when something breaks. Coolify is Apache 2.0. Dokploy's core is Apache 2.0, with a separate source-available licence covering any proprietary components. Both install onto a fresh Ubuntu VPS with one script, and both keep your applications running if the control plane goes down. Summary: Both put a Heroku-style deploy UI on your own VPS, but on different container primitives. What that means for zero-downtime deploys, multi-server growth and the day the control plane breaks. Tested with: operatingSystem Ubuntu 24.04 LTS, docker 27.x, dokploy v0.x, installed June 2026, coolify v4, installed June 2026, server 4 vCPU / 8 GB RAM, single node Prerequisites: - Working knowledge of Docker and Docker Compose - A VPS you are willing to reinstall while evaluating Questions answered: - Do my apps keep running if the Dokploy or Coolify dashboard crashes? — Yes, in both cases. The control plane schedules containers, it does not sit in the request path. Traffic goes through the reverse proxy, which is a separate container. You lose the ability to deploy, view logs and change configuration until the dashboard is back. - Can I migrate from one to the other later? — There is no import tool. What transfers is your Dockerfile or `compose.yaml`, your environment variables and your database dumps — which is most of the work if you kept configuration in the repo rather than typed into the UI. Plan on an afternoon per application. - Which one handles zero-downtime deployments better? — Dokploy, because Swarm services do rolling updates natively once you define a health check. Coolify can do it too, but you are configuring the behaviour rather than getting it by default. - Is either of these suitable for a production system with real users? — For a single-team application on one or two servers, yes — with the same caveats as any self-hosted infrastructure. You own patching, backups and the pager. Neither replaces a managed platform if nobody on the team wants to operate Linux. - Do I still need to understand Docker? — Yes. Both hide Docker until something fails, at which point you are reading `docker service ps` or `docker logs` output. Treat the UI as convenience, not as an abstraction you can stay above. Primary sources: - Dokploy documentation: https://docs.dokploy.com/docs/core - Dokploy source repository: https://github.com/Dokploy/dokploy - Dokploy LICENSE.MD — Apache 2.0 core with a /proprietary carve-out: https://github.com/Dokploy/dokploy/blob/canary/LICENSE.MD - Dokploy Source Available License (DSAL) 1.0: https://github.com/Dokploy/dokploy/blob/canary/LICENSE_PROPRIETARY.md - Coolify LICENSE — Apache License 2.0: https://github.com/coollabsio/coolify/blob/main/LICENSE - Coolify documentation: https://coolify.io/docs - Coolify source repository: https://github.com/coollabsio/coolify - Swarm mode key concepts: https://docs.docker.com/engine/swarm/key-concepts/ --- ## How to Fix the Docker Too Many Open Files Error on Ubuntu URL: https://codenx.com/troubleshooting/fix-docker-too-many-open-files/ Type: troubleshooting · Difficulty: intermediate Published: 2026-03-12 Updated: 2026-05-28 Last verified: 2026-05-28 Author: swadesh Topics: troubleshooting, docker, ubuntu, vps Direct answer: Check the limit the process actually has with `docker exec sh -c 'ulimit -n'` and compare it to the open count in `/proc//fd`. If they are close, raise it per service with a `ulimits.nofile` block in `compose.yaml`, or for every container with `default-ulimits` in `/etc/docker/daemon.json`. If the count keeps climbing after a restart, you have a descriptor leak in the application and raising the limit only delays the failure. Summary: Diagnose which file descriptor limit you actually hit — container, daemon or kernel — then raise it properly, and work out whether the real problem is a leak rather than a limit. Tested with: operatingSystem Ubuntu 24.04 LTS, kernel 6.8, docker 27.x, systemd 255 Prerequisites: - Root or sudo access on the Docker host - The name of the container that is failing Questions answered: - Why does ulimit -n on the host show a different value than inside the container? — Containers inherit limits from the Docker daemon's process, not from your login shell. The daemon runs under systemd with its own `LimitNOFILE`, and `docker run --ulimit` or `default-ulimits` overrides that per container. - Is it safe to set nofile to a very large number? — Setting a soft limit in the tens of thousands is normal. Setting it to 1048576 or higher can hurt: some programs allocate arrays sized by the limit or loop over every possible descriptor on startup, which turns a large limit into slow startup and high memory use. - Do I need to restart the container after changing the limit? — Yes. Resource limits are applied when the process is created and cannot be changed for a running process from outside. `docker compose up -d` after editing the file recreates the container. - What is the difference between the soft and hard limit? — The soft limit is what the process gets; the hard limit is the ceiling it may raise itself to. Set both. A soft limit alone is enough for most applications, but some raise their own at startup and need the headroom. - The error mentions inotify instead of open files. Is that the same fix? — No. Watchers are a separate kernel resource controlled by `fs.inotify.max_user_watches` and `fs.inotify.max_user_instances`, counted per user across the whole host. `ulimit -n` has no effect on it. Primary sources: - Docker Compose ulimits: https://docs.docker.com/reference/compose-file/services/#ulimits - dockerd reference — default-ulimits: https://docs.docker.com/reference/cli/dockerd/ - systemd.exec — LimitNOFILE: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html - inotify(7): https://man7.org/linux/man-pages/man7/inotify.7.html --- ## How to Secure a VPS That Runs Docker Containers URL: https://codenx.com/vps/secure-vps-running-docker/ Type: deployment-guide · Difficulty: intermediate Published: 2026-03-05 Updated: 2026-07-08 Last verified: 2026-07-08 Author: swadesh Topics: vps, security, docker, ubuntu Direct answer: Harden SSH to key-only authentication, enable a default-deny UFW policy, then stop Docker from publishing container ports past that firewall — bind published ports to `127.0.0.1` and add an explicit DROP rule at the top of the `DOCKER-USER` iptables chain. UFW alone does not protect published container ports, because Docker writes its own DNAT rules that are evaluated before UFW's. Summary: SSH hardening, a default-deny firewall, and the fix for the problem that catches almost everyone — Docker publishing container ports straight past UFW into the public internet. Tested with: operatingSystem Ubuntu 24.04 LTS, docker 27.x, ufw 0.36.2, openssh 9.6p1, fail2ban 1.0.2 Prerequisites: - A fresh Ubuntu 24.04 VPS you can reach over SSH - An SSH key pair on your local machine - Console or rescue access from your provider, in case you lock yourself out Questions answered: - Why does UFW not block my Docker container ports? — Docker inserts its own DNAT and FORWARD rules into iptables when you publish a port. Those rules sit in the `DOCKER` and `DOCKER-USER` chains, which are traversed before the chains UFW manages, so a published port is reachable regardless of what `ufw status` says. - Is it safe to disable Docker's iptables management in daemon.json? — No, not as a firewall fix. That stops Docker managing NAT at all, which breaks container-to-internet traffic and port publishing until you write every rule yourself. Bind published ports to localhost instead. - Should I change the SSH port to something other than 22? — It removes most automated scan noise from your logs, and that is the whole benefit — it is not a security control. Key-only authentication is. On Ubuntu 24.04 changing the port also means editing the socket unit, not just sshd_config. - Do I need fail2ban if password authentication is disabled? — It stops adding much for SSH once passwords are off. It is still useful for anything else you expose that does accept passwords, and it keeps the auth log readable. - How do I check what is actually exposed from outside? — Scan from a different machine — `nmap -Pn -p- your.server.ip`. Checking `ss -tlnp` on the host tells you what is listening, which is not the same question as what the internet can reach. Primary sources: - Docker and iptables: https://docs.docker.com/engine/network/packet-filtering-firewalls/ - Docker daemon configuration file: https://docs.docker.com/reference/cli/dockerd/ - Ubuntu Server security documentation: https://documentation.ubuntu.com/server/how-to/security/ - sshd_config manual page: https://man.openbsd.org/sshd_config - Fail2Ban documentation: https://github.com/fail2ban/fail2ban --- ## How to Point a Cloudflare Domain at Your VPS URL: https://codenx.com/cloudflare/point-cloudflare-domain-to-vps/ Type: configuration-guide · Difficulty: beginner Published: 2026-02-26 Last verified: 2026-05-14 Author: swadesh Topics: cloudflare, vps, security Direct answer: Add an A record in Cloudflare pointing your hostname at the VPS public IPv4 address, leave the proxy status on (orange cloud) for web traffic, and set SSL/TLS encryption mode to Full (strict). Then install a Cloudflare Origin CA certificate on the server and restrict the firewall so ports 80 and 443 only accept connections from Cloudflare's published IP ranges. Keep SSH on a DNS-only record or move it behind a tunnel. Summary: Create the A record, pick the right proxy status, set the SSL mode to Full (strict) and lock the origin so only Cloudflare can reach it — plus what errors 521, 522, 525 and 526 actually mean. Tested with: cloudflareDashboard July 2026, operatingSystem Ubuntu 24.04 LTS, nginx 1.24, originCertificate Cloudflare Origin CA, RSA 2048 Prerequisites: - A domain already using Cloudflare nameservers - A VPS with a public IPv4 address and a web server listening on 443 Questions answered: - Should the orange cloud be on or off? — On for anything that serves HTTP or HTTPS on a standard port — that is what gives you the WAF, caching and a hidden origin IP. Off for SSH, mail, game servers, or any protocol Cloudflare's proxy does not handle. - Why does my site redirect endlessly after enabling Cloudflare? — The encryption mode is set to Flexible. Cloudflare connects to your origin over plain HTTP, your server sees an insecure request and redirects to HTTPS, and the loop repeats. Switch to Full (strict). - Can I still SSH to the server after proxying the domain? — Not through the proxied hostname. Use a separate DNS-only record such as `ssh.example.com`, connect by IP address, or put SSH behind a Cloudflare Tunnel. The proxy only forwards HTTP and HTTPS on a fixed set of ports. - Do I still need Let's Encrypt if I use a Cloudflare Origin certificate? — No, as long as every visitor arrives through Cloudflare. An Origin CA certificate is only trusted by Cloudflare, so a direct browser visit to the IP will show a certificate warning. Keep Let's Encrypt if you need the origin to be independently reachable. - How long do DNS changes take to apply? — Proxied records change almost immediately, because Cloudflare's edge is already answering for the hostname. DNS-only records are subject to the TTL you set — leave it on Auto during a migration. Primary sources: - Manage DNS records: https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/ - Proxy status: https://developers.cloudflare.com/dns/proxy-status/ - SSL/TLS encryption modes: https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ - Cloudflare Origin CA certificates: https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/ - Cloudflare IP ranges: https://www.cloudflare.com/ips/ --- ## How to Deploy n8n on an Ubuntu VPS with Docker URL: https://codenx.com/n8n/deploy-n8n-vps-docker/ Type: tutorial · Difficulty: intermediate Published: 2026-02-18 Updated: 2026-06-20 Last verified: 2026-06-20 Author: swadesh Topics: n8n, docker, vps, ubuntu Direct answer: Run n8n on a VPS with a three-service Docker Compose stack: n8n itself, PostgreSQL for storage, and Caddy in front for automatic HTTPS. Point an A record at the server, set `N8N_ENCRYPTION_KEY` and `WEBHOOK_URL` before the first start, keep port 5678 unpublished so only Caddy can reach n8n, and back up both the Postgres database and the encryption key. Summary: A production n8n install on Ubuntu 24.04 using Docker Compose, PostgreSQL and Caddy for automatic TLS — with the encryption key, webhook URL and backup steps most quickstarts leave out. Tested with: operatingSystem Ubuntu 24.04 LTS, docker 27.x, dockerCompose v2.29, n8n 1.60, postgresql 17, caddy 2.8 Prerequisites: - An Ubuntu 24.04 VPS with at least 2 GB RAM and a public IPv4 address - A domain name whose DNS you control - SSH access as a non-root user with sudo Questions answered: - Do I need PostgreSQL, or is the default SQLite enough? — SQLite is fine for a personal instance with a handful of workflows. Move to PostgreSQL before you have concurrent executions or more than a few thousand execution records — SQLite write contention shows up as slow or stuck executions long before the database gets large. - What happens if I lose N8N_ENCRYPTION_KEY? — Every stored credential becomes unreadable. n8n encrypts credentials with that key, and there is no recovery path — you re-enter every API key and OAuth connection by hand. Back the key up separately from the database. - Why do my webhook URLs show localhost or an IP address? — `WEBHOOK_URL` is unset or wrong. n8n builds production webhook URLs from that variable, not from the request host, so it must be the full public URL including the scheme and a trailing slash. - Can I run this without a domain name? — You can reach the UI over plain HTTP on the server IP, but do not. n8n stores API keys and OAuth tokens; without TLS they cross the network in cleartext, and OAuth callbacks from most providers require HTTPS anyway. - How do I upgrade n8n safely? — Take a database dump, change the image tag in `compose.yaml`, then run `docker compose pull && docker compose up -d`. Read the release notes for breaking changes first — n8n occasionally migrates the database schema on start, and that migration is not reversible. Primary sources: - n8n Docker installation: https://docs.n8n.io/hosting/installation/docker/ - n8n environment variables reference: https://docs.n8n.io/hosting/configuration/environment-variables/ - Install Docker Engine on Ubuntu: https://docs.docker.com/engine/install/ubuntu/ - Caddyfile concepts: https://caddyserver.com/docs/caddyfile/concepts - pg_dump: https://www.postgresql.org/docs/current/app-pgdump.html