Required
Supabase
Authentication, Postgres, RLS, vectors, and application state.
Infrastructure
Clear dependencies. Operator-owned accounts.
Tube keeps required services explicit and optional capabilities separable. Self-hosted operators retain control of their data, media, credentials, and infrastructure contracts.
Required boundaries
The state and media foundations every production deployment needs.
Required
Operator-owned media
Persistent source storage, transcoded renditions, posters, and playback delivery.
Runs on infrastructure controlled by the operator.
Optional services
Enable only the capabilities your operation uses.
Optional
Resend / Postmark
Transactional email delivery.
Optional
Cloudflare Turnstile
Bot protection on signup and comments.
Optional
Arcjet
Request-level security: rate limit, bot detection, shield.
Optional
AI model access
Optional metadata understanding and editorial assistance.
Optional
Sentry
Error tracking (env-toggle).
Optional
Web Vitals reporting
Built-in /api/vitals endpoint.
Health and operations endpoints
Probe-friendly routes for orchestrators, monitors, and fleet tooling.
- /api/healthLiveness probe
- /api/readyReadiness across critical services
- /api/versionRunning build version
- /api/verifySigned license verification
- /api/revalidateTrigger ISR revalidation
Configuration guidance lives in the environment reference. Secrets belong in the deployment environment, never the codebase.