Solution profiles — Noderyx Documentation

01

Why a profile exists

A blog and a trading platform want opposite things from the same framework. One wants pages cached for an hour; the other wants market data no older than thirty seconds. Rather than leave every ceiling at a compromise value and hope you tune it later, Noderyx ships named profiles that set sensible starting points for the product you actually named.

A solution profile presets cache lifetimes, cache size, and traffic ceilings.
A security profile presets request hardening, session lifetimes, and header strictness.
Both are ordinary values written into your generated project—nothing is hidden at runtime.
Every value a profile sets can still be overridden by an environment variable.

NOTE

Profiles are a starting point chosen for you, not a mode you are locked into.

02

Choose one when you create the project

The --profile flag on noderyx new selects the solution profile. It seeds noderyx.config.js, writes APP_PROFILE into .env, and uses the profile's description as the initial SITE_DESCRIPTION.

TERMINAL

npx noderyx-framework new my-app --profile=saas
npx noderyx-framework new exchange --profile=trading
npx noderyx-framework new shop --profile=ecommerce --database=postgres

NOTE

The default is saas when no flag is given.

03

The six solution profiles

Each profile names a shape of product and answers one question: how long may this application serve something it already has?

saas SaaS product. A scalable subscription product with dashboards, teams, and APIs.

trading Trading platform. Low-latency, live market data, secure APIs.

blog Blog. A fast, search-friendly publication built for articles and media.

ecommerce E-commerce site. Catalog, checkout, and order APIs with conversion in mind.

static Static site. Lightweight, optimized for global delivery and SEO.

enterprise Enterprise solution. Secure and high-capacity, for complex teams and integrations.

NOTE

Aliases are accepted and normalised: shop and commerce mean ecommerce, corporate means enterprise, and software-as-a-service means saas.

04

What each profile actually sets

The numbers are the whole point, so they are worth reading before you choose. Cache TTL is how long an entry stays fresh; static max-age is what a browser is told about files under /public.

SOLUTION PROFILES

PROFILE      CACHE TTL   MAX ITEMS   STATIC MAX-AGE   BODY LIMIT   RATE/MIN
saas             900s        2048         7 days           2 MB        600
trading           30s        4096         1 day            1 MB       1200
blog            3600s        1024        30 days           2 MB        300
ecommerce        300s        2048         7 days           2 MB        600
static         86400s         512         1 year         256 KB        200
enterprise       600s        8192         7 days           4 MB       1500

NOTE

trading caches for 30 seconds because stale prices are worse than a cache miss; static caches for a year because the file will not change without a new name.

05

How it reaches your configuration

The generator writes the profile lookup into noderyx.config.js. It resolves at startup from APP_PROFILE, so the same build can be switched between profiles by changing one environment variable.

noderyx.config.js

import { envNumber, securityProfile, solutionProfile } from "noderyx-framework";

const profile = solutionProfile(process.env.APP_PROFILE ?? "saas");

export default {
  cache: {
    ttl: envNumber("CACHE_TTL", profile.cache.ttl),
    maxItems: envNumber("CACHE_MAX_ITEMS", profile.cache.maxItems),
    staticMaxAge: envNumber("CACHE_STATIC_MAX_AGE", profile.cache.staticMaxAge)
  }
};

NOTE

Read the precedence carefully: the profile supplies the default and the environment variable wins. Setting CACHE_TTL in .env overrides the profile without editing it.

06

Security profiles are a separate dial

SECURITY_PROFILE is independent of APP_PROFILE. It sets how strictly requests, sessions, and headers are policed, and it is the right dial for a regulated application regardless of what the product is.

standard The framework defaults. Safe for most applications.

strict 512 KB bodies, 20s request timeout, 8-hour sessions with a 30-minute idle timeout, SameSite=Strict, frame-ancestors 'none'.

banking Everything in strict, tightened further: 256 KB bodies, enforced HTTPS, 15-minute idle timeout, rolling sessions, two-year HSTS with preload, no-referrer, and a locked-down Permissions-Policy.

.env

SECURITY_PROFILE=banking

NOTE

An unknown name throws at startup rather than silently falling back—a typo in a security setting should never be survivable.

07

Combining the two

The generated security block spreads the security profile first and then applies its own keys, so a solution profile and a security profile can be used together—as long as you know which one wins where.

noderyx.config.js

security: {
  ...securityProfile(process.env.SECURITY_PROFILE ?? "standard"),
  appKey: process.env.APP_KEY,
  bodyLimit: envNumber("REQUEST_BODY_LIMIT", profile.security.bodyLimit),
  rateLimit: { windowMs: 60000, max: envNumber("RATE_LIMIT_MAX", profile.security.rateLimitMax) },
  session: { name: "noderyx_session", maxAge: 604800, sameSite: "Lax" }
}

NOTE

This matters: the keys written after the spread replace the security profile's versions of them. In a generated project, SECURITY_PROFILE=banking still gives you HTTPS enforcement, request hardening, and the header policy—but bodyLimit, rateLimit, and session come from the block below it. Delete those lines, or lower them by hand, if you want the profile's stricter values.

08

Resolve a profile in your own code

Both helpers are exported, so application code, packages, and scripts can read the same values the configuration used. Each call returns a fresh copy, so mutating the result cannot affect anything else.

JAVASCRIPT

import { solutionProfile, solutionProfiles, securityProfile } from "noderyx-framework";

solutionProfiles;                 // ["saas", "trading", "blog", ...]
solutionProfile("trading").cache; // { ttl: 30, maxItems: 4096, ... }
securityProfile("banking", { rateLimit: { max: 60 } });

NOTE

securityProfile() takes an overrides object as its second argument and merges it per-section, which is the tidiest way to keep a profile and still change one number.

09

Choosing well

The profile is a starting point, and the right one is usually obvious from the product. These are the questions worth answering before you commit.

How stale may a page be? That single answer picks most of the cache column for you.
How large is a legitimate request? Set the body limit just above it, not far above it.
Is the data regulated or financial? Then the security profile matters more than the solution profile.
Are you behind a CDN? A long static max-age is cheap; a long HTML TTL rarely is.
Changing your mind later is one environment variable, not a migration.

TERMINAL

node --input-type=module -e "const {default:c}=await import('./noderyx.config.js');console.log(c.cache,c.security.profile)"

NOTE

Verify what you ended up with rather than assuming—printing the resolved config shows the profile after every environment override has been applied.