BrainstormRouter runs live on AWS Fargate for ~$0 incremental — full routing for ~$28/mo

2026-06-28

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: ["none"] sdk_methods_updated: ["none"] mcp_tools_updated: ["none"] ---

What We Built

A self-contained Terraform module, terraform/fargate-minimal/, that stands up BrainstormRouter on AWS in two tiers from a single apply:

• Minimal mode (enable_routing = false): one Fargate task running the

gateway with embedded file-based stores. No ALB, no NAT, no database. Compute is absorbed by the account's Compute Savings Plan, so the incremental cost is ~$0.

• Routing mode (enable_routing = true, default): adds RDS Postgres

(pgvector) + ElastiCache Redis and the env/secret wiring needed for the full multi-tenant /v1 API — tenant signup, API-key issuance, encrypted BYOK provider keys, and live model routing.

The module is deliberately isolated from the legacy production stack in terraform/.tf (the full ~$1,050/mo footprint). It uses local state and reuses the default VPC, the surviving brainstorm-router-ecs- IAM roles, and a single JSON secret in Secrets Manager. apply/destroy is a clean on/off switch.

Why It Matters

After the cost-driven teardown, the project needed a way to keep building and to come back online without the always-on bill. This module makes "run it anywhere, cheaply" real: the same published container image runs locally ($0), on Savings-Plan-covered Fargate (~$0 incremental), and — when durable data is needed — on managed RDS+Redis for ~$28/mo. That is a 93% reduction from the pre-teardown run rate while preserving the full product surface.

How It Works

Routing mode boots the gateway with the exact env set required to light up the real /v1 pipeline (each flag was load-bearing and verified live):

Variable	Effect
BRAINSTORMROUTER_API_ENABLED=1	mounts the Hono /v1 REST API
BRAINSTORMROUTER_ROUTER_ENABLED=1	initializes the model router + capability runtime
AGENT_JWT_SECRET	required when the API runs in production mode
LOCAL_KEK_SECRET	envelope-encrypts tenant provider keys at rest (the image ships without @aws-sdk/client-kms, so the KMS path is unavailable)
ANTHROPIC_API_KEY	populates the model catalog at boot via env auto-discovery
DATABASE_URL / REDIS_URL	RDS + ElastiCache connection strings

Datastores are private (default-VPC, ingress only from the gateway security group). Schema migrations run as a one-off node dist/db/migrate.js Fargate task inside the VPC. The image is built on Apple Silicon (arm64), so the task runs on Fargate Graviton (runtime_platform = ARM64) — matching the image and ~20% cheaper.

End-to-end verified on the live instance: POST /v1/signup → POST /v1/signup/verify (code read from RDS) → POST /v1/providers (BYOK anthropic key) → POST /v1/chat/completions with model: "auto", which auto-selected claude-haiku-4-5-20251001 and returned a real completion with cost_usd tracked.

The Numbers

• Incremental compute cost: ~$0 — the Fargate Graviton task fits under the

existing $0.067/hr Savings Plan commitment (valid through 2027-04-19).

• Routing stack: ~$28/mo (db.t4g.micro + cache.t4g.micro), single-AZ.
• Total run rate in routing mode: ~$77/mo vs. ~$1,050/mo pre-teardown (93%

lower).

• Time from cold to live routing: one terraform apply + a one-off

migration task.

Competitive Edge

Most gateways (Portkey, OpenRouter) are someone else's hosted service. This is the whole BrainstormRouter engine — auto-selection, BYOK, cost tracking, security subsystems — running on infrastructure you own, portable across local / Fargate / any VPS from one image, and switchable on and off at the cost of a terraform destroy. The model: "auto" request picking the cost-optimal Haiku is the differentiator working by default.

Lockstep Checklist

> Infra-only change. No src/api/routes/ modifications, so no SDK/MCP surface > updates are required.

• [x] API Routes: none changed (infra only).
• [x] TS SDK: n/a.
• [x] Python SDK: n/a.
• [x] MCP Schemas: n/a.
• [ ] Master Record: no new capability — existing /v1 surface, new deploy path.