Do I need MongoDB to start?

No. SQLite is the default — npm run dev just works, data lands in ./db/app.db. Add MONGODB_URI — or Supabase keys plus one schema.sql run — and flip one variable when you're ready for prod.

My stack is different — can I still use it?

If you're comfortable with React and Next.js, yes. The pieces are independent: swap LemonSqueezy for Stripe or Dodo, MongoDB or Supabase for SQLite, and configure Resend with one variable.

Can I deploy this on a cheap VPS?

Yes — that's the point. SQLite needs no database server, .env.prod loads with one command, and next start serves everything. A $5 box is plenty to start.

Is the code actually readable?

Small modules, one job each: providers/db/* per database, providers/billing/* per rail, one-line registries. Delete a folder + one line to remove a feature.

Agent-First · Next.js SaaS Boilerplate

The convention-driven Next.js boilerplate for autonomous AI agents — Ship your startup.
Let agents do the job.

The Next.js based solo-founder kit for autonomous AI agents. Strict conventions keep Claude Code, Cursor, and Antigravity on track—auth, payments, and 3 databases already wired.

Zero blast radius — new features never break old ones
Strict conventions — zero AI coding slop
Start instantly on SQLite ($5 VPS) · Graduate to Supabase Postgres as you scale
Auth, 3 payment gateways & boards pre-wired

Launch with agents Peek inside ↓

✓ Built for Claude Code, Cursor, Antigravity & OpenCode · zero external bloat · yours forever

+ all the boring stuff (built-in analytics, auth, SQLite, webhooks)

Payments Supported

Stripe

Lemon Squeezy Dodo logo

Dodo

Databases Supported

SQLite

MongoDB

Supabase

Single $5 VPS ready (SQLite) · Managed Cloud ready (Supabase & MongoDB)

Storage Supported

Cloudflare R2 AWS S3 logo

AWS S3

Cloudflare R2 ($0 egress) · AWS S3 (industry standard)

Email & Deployment

Resend

Docker

Resend REST · 1-Push Git Deploy & Docker (0 Vercel tax)

11API routes32components3databases1-pushin-built deploy0-depsbackground workers3payment providers2storage engines

🚀 In-built git push deploy✦⚙️ 0-deps background workers✦💾 Native SQLite VACUUM backups✦🛡️ Zero open port 22 with Tailscale✦🍪 No cookie banners✦⚡ 0ms SQLite in production✦🛡️ Defuse AI slop grenades✦🐳 1-command Docker deploy✦💰 $0 database hosting fees✦📡 Real-time tracking✦🚨 Pocket incident alerts✦💰 Revenue attribution✦🗺️ Journey mapping✦⏱️ 60-second setup✦🔒 Privacy-friendly✦💬 Feedback + analytics in one✦🚀 In-built git push deploy✦⚙️ 0-deps background workers✦💾 Native SQLite VACUUM backups✦🛡️ Zero open port 22 with Tailscale✦🍪 No cookie banners✦⚡ 0ms SQLite in production✦🛡️ Defuse AI slop grenades✦🐳 1-command Docker deploy✦💰 $0 database hosting fees✦📡 Real-time tracking✦🚨 Pocket incident alerts✦💰 Revenue attribution✦🗺️ Journey mapping✦⏱️ 60-second setup✦🔒 Privacy-friendly✦💬 Feedback + analytics in one✦

Boring in 15 seconds

boringpush.com/watch

1080p

0:00 / 0:00

What You'll Get

Revenue-first analytics.

Discover which marketing channels bring customers so you can grow your business, fast.

Every pageview, entry point and drop-off path
Real hardware detection: Safari, Chrome, iOS & Mac
Referrer attribution: tweet, launch post or sponsor
Journeys that end in $$$ checkout conversions
Local SQLite persistence with zero cookie banners
One-click CSV export & raw event querying

providers/analytics/

Visitors7,55242% ↑

Revenue$5,95413% ↑

Conversion rate0.34%17% ↓

Revenue/visitor$0.7920% ↓

Bounce rate86%5% ↑

Session time2m 13s31% ↓

Online1

Autonomous Mobile Deployments

Ship from your phone.
Zero production panics.

The most prolific solo founders aren't glued to their desks anymore. Pieter Levels and so many other indie makers are shipping features, closing support tickets, and pushing to live servers directly from their phones with Termius and Claude Code.

If they can ship from their phone on the couch—so can you.

pushing code from phone is so amazing and its only possible since last few months cause agents can handle massive context and limited tooling scopes better now
— jack friks (@jackfriks) (August 11, 2026)

can't believe I ship code from my phone now
— Kent (@kentdebruin) (August 28, 2026)

my mac is now 24/7 reachable and i can use codex and claude from anywhere :) here is my setup: 1. install amphetamine so your mac does not sleep and stays on. 2. install amphetamine power protect so you can close the lid and the mac still keeps running. 3. install tailscale...
— Andi (@andilosing) (June 24, 2026)

.@levelsio I code from my phone now because of your post. Wrapped the whole setup into one command. pocketdev: • Hetzner box running your AI CLI (Claude Code, Codex, Cursor, Gemini…) on your own subscription • Tailscale-only, empty Hetzner firewall, nothing inbound • code…
— Massi — oss/acc (@0xMassi) (June 29, 2026)

i still can’t get over how much power i have from my phone. coding new features, closing customer support tickets, optimizing wedding website - all while watching the baseball game on my couch after dinner :)
— jack friks (@jackfriks) (August 10, 2026)

This is how I code now about half the time. From my phone with Termius coding on my VPS and writing requests into Claude Code like a goon
— @levelsio (@levelsio) (January 5, 2026)

The Zero-Panic Guarantee

Why mobile shipping terrifies founders—and how Boring makes it safe.

Prompting an AI agent from your phone is suicide if your codebase has no guardrails. One hallucinated npm package, one unchecked database migration, or one broken auth claim drops production while you're away from your laptop. Here is why normal apps crash, and how our strict .agents/ rules guarantee zero downtime.

Vibe-coded apps + stock boilerplates

UNSTABLE

Why vibe-coded apps break live users

Phantom npm installs: The AI invents non-existent packages or installs dead npm wrappers that fail container builds and leak secrets.
Accidental database wipes: One bad prompt runs an unchecked migration, dropping live tables or locking production with unindexed queries.
200-line spaghetti routes: The AI dumps raw unreadable logic into endpoints without transactions and forgets to check if the user actually paid.
Infinite login loops: Corrupted session cookies and auth claims trap your paying customers in endless redirects.
API keys leaked in the browser: The model bakes Stripe and OpenAI secret keys directly into frontend code for anyone to scrape.
No undo button: The AI touches 15 files at once, breaks the build, and leaves you stranded with no rollback plan.

Production outcome:Broken checkout at 2:45 AM

How Boring keeps autonomous ships rock-solid

Zero package hallucinationsThe AI is strictly banned from installing rogue npm wrappers. It uses native Node.js and Next.js built-ins only.

Never lose customer dataAdditive-only migrations guarantee tables and columns can never be dropped or wiped in production.

Under-40-line route ruleClean, readable endpoints guarded by a 1-line requirePaidUser() check and automatic rate limits.

Tri-database parityThe AI writes schemas for SQLite, MongoDB, and Supabase at once—switching databases takes one variable.

Automated zero-warning gateEvery agent edit must pass node --check and lint with 0 warnings before it can deploy.

✓ Shipped in 45s·Zero production breaks

9:41

ssh:boring-prod

AGENT_READY

❯ yo can u add team invites + charge per seat??

⚡ invoking .agents/skills/billing-seats...

✓ schema patch: +seats on orgs (additive)

✓ webhook: customer.subscription.updated

✓ guard: requireOrgAdmin() passed

✓ test: 14/14 passed · 0 lint warnings

🚀 Shipped to prod1m 48s

agent@box:~/app$

Sent from your phone → prod stayed green

Ready for Claude Code, Cursor & Antigravity100% compliant with CONVENTIONS.md

Act II · The switch

Deploy on a $5 server. Or scale to the cloud.

Run your entire SaaS on a single $5/month VPS with production SQLite, 0ms query latency, and zero database bills. Or flip one environment variable to switch to Supabase Postgres or MongoDB Atlas. The application code never rewrites a query.

Single $5 VPS Host (SQLite in Prod)

# Run app + db + analytics on a $5 server
DB_PROVIDER=sqlite
SQLITE_PATH=/var/data/app.db
BILLING_PROVIDER=dodo

✓ 0ms RAM latency · 100k+ ops/sec · $0/mo DB bill

Managed Cloud Cluster (1 Switch)

# Point to Supabase or Atlas with 1 env variable
DB_PROVIDER=supabase # or mongodb
SUPABASE_URL=https://xyz.supabase.co
BILLING_PROVIDER=stripe

✓ Exact same models · 0 lines of app code changed

In-Built Zero-CI Deploy · PM2 + Tailscale

git push production main. Done.

Local pre-push hook runs node --check and zero-warning lint gates before code leaves your laptop. Git transports commits to your $5 VPS over encrypted SSH or private Tailscale WireGuard. PM2 reloads with zero downtime.

✓ $0 hosted CI bills✓ Zero open port 22 (Tailscale)✓ 0.00s PM2 reload

Laptop ➔ VPS Bare RepoZero CI overhead

❯ git push production main

✔ [PM2] myapp online (Zero downtime)

Silent Workers · Self-Healing Maintenance

A quiet night crew that works while you sleep.

No Redis clusters to babysit. No third-party cron bills. While you're offline, silent background routines create fresh database backups, sweep away old logs, and reclaim disk space—so you never wake up to an out-of-memory emergency.

✓ 0 extra servers to host✓ Fresh nightly backups✓ Never wakes you up

Night Shift · scripts/workers/Running in shadows

❯ npm run worker:daily

✔ Backups saved · Logs rotated · 0ms user impact

Act II.2 · The Slop Grenade Tax

Your app won't fail from competition. It'll die from an AI slop grenade.

Give an autonomous AI agent a blank, un-opinionated repository and watch it toss a slop grenade into your codebase: hallucinating 10 npm packages, inventing 4 conflicting folder structures, and locking your production database. Unconstrained agents don't build software—they force you to clean up their architectural mess.

Unstructured AI development balance sheet

+ Defusing AI slop grenades: hallucinated packages & broken builds20 hrs
+ Untangling un-opinionated folder spaghetti and duplicate models16 hrs
+ Resolving destructive ORM schema migrations that locked prod DB24 hrs
+ Fixing silent regressions when a new feature breaks existing code18 hrs
+ Refactoring 250-line bloated route handlers leaking secrets14 hrs
+ Fixing auth redirect loops and stale JWT cookies8 hrs
+ Paying $29/mo for hosted Postgres before making your first dollar$29/mo
+ Paying $49/mo for Sentry only to wake up to 2,000 alert emails$49/mo
+ Paying $20/mo for hosted CI minutes and debugging runner YAML$20/mo
+ Wrestling with Redis, Celery, or BullMQ just to run 2 simple cron jobs16 hrs
+ Debugging ghost memory leaks from state stored in module globals10 hrs
+ Arguing over stack architecture instead of shipping∞ hrs
= Total architectural slop debt100+ hrs lost

Strict conventions eliminate chaotic architecture debates. When an autonomous agent has rigid rules for schemas, providers, and thin routes, it stops creating slop and starts shipping production software.

const agent_output = "Production code. Zero slop.";

The Anti-Regret Architecture · Blast Radius: 0%

Never break what's already paying you.

Every solo builder knows the cold dread in their stomach: you ask an AI to add a simple feature, and it quietly breaks the checkout that pays your bills. Your Saturday is gone, your customers are locked out, and you're frantically debugging code you didn't even write. In Boring, your revenue code is sacred. Every new feature is quarantined in its own folder—completely blocked from touching your working auth, your database, or your Stripe checkout.

Bad programmers worry about the code. Good programmers worry about data structures and their relationships.

— Linus Torvalds·Creator of Linux & Git

Why BoringPush enforces a strict Data-First rule: schemas defined on SQLite, MongoDB, and Supabase first. When data structures are immutable contracts, your application code stays simple, boring, and immune to AI churn.

Your revenue code is sacred

The checkout that pays your bills is completely off-limits to new code. Every new feature lives in its own quarantined folder with its own isolated routes. Your AI can build freely without ever touching your login, your payment webhooks, or your active customer sessions.

Checkout stays untouchedZero regressions

Never trapped by your stack

Tired of watching your database bill grow before your product even has revenue? Or locked into Stripe when you need global merchant-of-record payouts? Change a single word in your config. Your models, your routes, and your application code stay untouched. Zero rewrites. Zero regret.

Zero vendor lock-in1-second tool switch

Your customer data is permanent

No accidental table drops. No wiped customer records. No runaway queries that freeze your live database while you're asleep. AI agents are hard-banned from running destructive migrations. Every change is strictly additive. Prompt from your phone at 2:00 AM knowing your customer data can never be destroyed.

Impossible to wipe prod100% crash-proof DB

Act IV · The lineup

Boring vs the hard way

How Boring stacks up against starting from a blank directory or wrestling with bloated multi-package frameworks.

Feature	Boring	From scratch	Typical boilerplate
Strict .agents/ rules (Defuse AI slop grenades)
Zero blast radius (new features never break old ones)
Locality of behavior (sandboxed feature pods)
Tri-database schema parity on every feature
Mobile production sessions with rollback safety
Production SQLite ($0/mo DB bill, 0ms latency, WAL mode)
One-switch SQLite ↔ Supabase (or MongoDB)
Production Docker out of the box (0 Vercel tax, self-host anywhere)
In-built zero-CI deploy (git push production main)
0-deps background workers & backups (0 Redis / 0 BullMQ)
Native SQLite VACUUM INTO snapshots & hourly WAL truncation
Tailscale private mesh option (Zero open port 22)
Stripe + LemonSqueezy + Dodo (3 Gateways)
Transactional email: Resend out of the box (0 npm bloat)
Thin routes (≤40 lines, zero memory leaks)
Built-in privacy analytics (zero cookies)
Pocket incident alerts + 1-tap phone fixes (Telegram/Discord)
Feedback & roadmap boards included
Magic links + Google OAuth (proven JWT)
Zero external npm bloat
Time spent fixing AI slop	0 hrs	Weeks	Days

Payment providers included — Stripe logo

Stripe

Lemon Squeezy Dodo logo

Dodo

Act V · Word on the street

Students, founders, and engineers love us

Real feedback from solo builders, founders, and engineers who stopped rebuilding and started shipping.

Founding cohort — batch closes soon

One payment. Yours forever.

Everything you need to build your SaaS, AI tool, or web app and make your first $ online.

$349.00 $199.00 USD

First 100 founders only — goes to $349 when batch closes.

Today's price is locked forever — v1.1 costs more.

Everything on this page, full source
1-push git deploy + multi-stage Dockerfile ($5 VPS)
All v1.x fixes & features
Private repo access + updates
Keep 100% of what you ship
Lifetime updates

Secure checkout · Runs locally in 60 seconds · Boring Promise: saves a weekend or rm -rf it

Act VII · Straight answers

Fair questions, no pitching

Have another one? Ask directly at [email protected]

Getting started

Absolutely. SQLite in Boring is fine-tuned for high-concurrency production: running in WAL mode (Write-Ahead Logging) with busy_timeout locks, automated hourly backups, and 0ms in-memory RAM latency. Because queries don't make network round-trips to an external server, they execute in microseconds and effortlessly handle 100,000+ daily visitors on a single $5 VPS. Best of all: you save $30–$50/month in hosted database bills before your app makes its first dollar.

Yes, of course! While SQLite is built for servers and Docker, if you love Vercel's serverless git-push workflow, simply set DB_PROVIDER to supabase (or mongodb) in your environment variables. Boring comes with battle-tested Supabase Postgres and MongoDB Atlas adapters out of the box with 100% schema parity. You get instant Vercel deploys with zero code rewrites. Start for $0 on a VPS, or deploy to Vercel the second you want serverless edge scale.

Yes — that's the whole point. Boring includes native zero-CI git-push deploy scripts AND an audited multi-stage Dockerfile. Both ways deploy with a single push ('git push production main') on any $5 Hetzner, DigitalOcean, or Tailscale box. Zero Vercel lock-in, zero serverless cold starts, and $0 database bills forever.

Run 'git push production main' directly from your laptop or phone. Your local machine executes a strict pre-push gate (node --check, lint, test, build). If clean, Git transports the commits to a bare repository on your VPS over encrypted SSH or private Tailscale WireGuard. The post-receive hook runs npm ci, builds Next.js, and commands PM2 to perform an online rolling reload with zero downtime. You get full production deployment in seconds with $0 hosted CI runner bills and zero open port 22 vulnerabilities.

Boring follows the Doug McIlroy / DHH Unix philosophy: small, focused procedural scripts dispatched via time buckets (hourly, daily, weekly, monthly) using atomic flock advisory file locking so jobs never overlap. Hourly runs truncate SQLite WAL sidecars (PRAGMA wal_checkpoint(TRUNCATE)) to keep disk usage lean. Daily runs trigger SQLite's native VACUUM INTO command to generate defragmented, atomic snapshots in db/backups/ without corrupting active WAL transactions, plus automated 90-day telemetry cleanup. Zero Redis instances to host, zero npm worker packages, and zero memory leaks.

A working app with auth, billing, and database in an afternoon — most of it is running the dev server and filling in keys. The boilerplate does the weeks-long parts: checkout flows, webhook verification, session handling, and deploy config.

Yes — this whole site runs on it. Click around: the boards, billing buttons, blog, and auth flows below are the product. The repo is the same code, plus setup docs.

Payments

Whichever you already have. Stripe is the default and battle-tested. LemonSqueezy and Dodo work through the same checkout/portal routes — change BILLING_PROVIDER, point your webhooks, done.

The provider webhook verifies the signature, then grants access: hasAccess, customerId and billingProvider are set on the user. Failed or cancelled subscriptions revoke it automatically.

It's your code forever once you have it, so there's nothing to take back. That's exactly why the Boring Promise exists: if it doesn't save you a full weekend, rm -rf it and tell us what hurt.

AI builders

That's what it's built for. Load the build-feature skill and any agent works data-first: same provider interfaces, verified with lint + smoke, following CONVENTIONS.md instead of inventing structure.

Stability. v4 is boring in the best way: JWT sessions work identically on all three databases, and the whole auth flow is smoke-tested. No beta surprises at 2am.

No. Every builder knows the sickening feeling of asking an AI to add something simple, only to find it broke your login flow or payment webhook. Boring stops this with radical Locality of Behavior: every feature lives in its own sandboxed folder with under-40-line routes and strictly additive database tables. When an agent creates a new feature, it is physically locked out of your working auth, checkout, or billing code. What works stays working.

Small modules, one job each: providers/db/* per database, providers/billing/* per gateway, one-line registries. Delete a folder + one line to remove a feature.

Final act · Your move

Stop burning weeks on plumbing.

Build your SaaS, AI tool, or web app and make your first dollar online fast. Zero-setup SQLite today, production cluster tomorrow.

Launch your idea instantly

The convention-driven Next.js boilerplate for autonomous AI agents — Ship your startup.Let agents do the job.

What You'll Get

Revenue-first analytics.

Ship from your phone. Zero production panics.

Why mobile shipping terrifies founders—and how Boring makes it safe.

Why vibe-coded apps break live users

How Boring keeps autonomous ships rock-solid

Deploy on a $5 server. Or scale to the cloud.

git push production main. Done.

A quiet night crew that works while you sleep.

Your app won't fail from competition. It'll die from an AI slop grenade.

Never break what's already paying you.

Your revenue code is sacred

Never trapped by your stack

Your customer data is permanent

Boring vs the hard way

Students, founders, and engineers love us

One payment. Yours forever.

Fair questions, no pitching

Getting started

Can I actually use SQLite in production?

Can I deploy Boring on Vercel?

Can I deploy this on a cheap VPS or with Docker?

How does the in-built zero-CI deploy work?

How do background jobs and database backups work without Redis or BullMQ?

How quickly can I launch with Boring?

Can I see what I'm getting before buying?

Payments

Which payment provider should I use?

What happens when a payment succeeds?

Can I get a refund?

AI builders

Does Boring work with AI editors like Cursor or Copilot?

Why NextAuth v4 and not v5?

Will building a new feature break my existing ones?

Is the code actually readable?

Stop burning weeks on plumbing.

The convention-driven Next.js boilerplate for autonomous AI agents — Ship your startup.
Let agents do the job.

Ship from your phone.
Zero production panics.