The modern AI app stack: Next.js, PostgreSQL and the services around them

The web application

Next.js supports running an application on a Node.js server or in a Docker container. Static export supports a narrower feature set. Choose a deployment target that supports the features your application actually uses.

Use TypeScript to make interfaces clearer, and validate untrusted inputs at runtime. Keep credentials and privileged operations on the server. A browser bundle is delivered to the visitor.

Data and permissions

PostgreSQL stores related records and supports transactions and constraints. Define ownership and uniqueness in the data model, then enforce access rules for every operation.

Row security can restrict records by policy, but PostgreSQL superusers and roles with BYPASSRLS bypass it; table owners normally do too. Test with the same application role used in production. Enabling a policy alone is not evidence of account isolation.

Files, jobs and models

Store uploaded file bytes in object storage and keep their metadata and ownership in the database. Check file access independently of page access. Keep email delivery and long-running jobs observable and retryable.

An AI gateway is an intermediary for model requests. Cloudflare documents controls including analytics, caching and rate limiting. Confirm provider support and logging behavior for your workload. Keep model identifiers and configuration replaceable rather than scattering them across the UI.

Wantlist’s current boundary

Wantlist now uses native Next.js. Its local preview still uses the existing local D1 and R2 emulation. PostgreSQL migration and a production R2 adapter are separate work items. This recommended stack must not be read as a claim that those production integrations are complete.