Best Practices

Follow these recommended patterns and practices for secure, scalable, and maintainable Nexus deployments.

• OAuth2 Authentication - Secure API access with JWT tokens
• TLS Configuration - Encrypted connections and certificates
• Client Identification - User tracking and tiered access

• Rate Limiting - Global and per-user limits
• LLM Rate Limiting - Token-based rate limiting
• MCP Rate Limiting - Tool usage controls

• Server Configuration - Core server settings
• LLM Configuration - Provider and model management
• MCP Configuration - Tool server setup

• OAuth2 authentication enabled
• TLS certificates configured
• Secrets in environment variables
• Rate limiting configured
• CORS properly restricted

• Redis for distributed rate limiting
• Connection caching optimized
• Appropriate timeouts set
• Resource limits defined

• Health checks configured
• Logging at appropriate level
• Monitoring in place
• Backup strategy defined
• Update process documented

• Never hardcode secrets
• Always use TLS in production
• Implement defense in depth
• Follow principle of least privilege

• Begin with strict rate limits
• Use minimal permissions
• Enable features gradually
• Monitor before scaling

• Design for horizontal scaling
• Use distributed storage (Redis)
• Implement caching strategies
• Monitor resource usage

• Automate deployments
• Version control everything
• Document configurations
• Test disaster recovery

# Development
[server]
listen_address = "127.0.0.1:8000"

# Production
[server]
listen_address = "0.0.0.0:443"
[server.tls]
certificate = "/etc/nexus/cert.pem"
key = "/etc/nexus/key.pem"

[server.client_identification]
enabled = true
client_id.jwt_claim = "sub"
group_id.jwt_claim = "plan"

[llm.providers.openai.rate_limits.per_user.groups.free]
input_token_limit = 10000
interval = "3600s"

[llm.providers.openai.rate_limits.per_user.groups.pro]
input_token_limit = 100000
interval = "3600s"

1. Hardcoding secrets - Always use environment variables
2. Skipping TLS - Never run without TLS in production
3. No rate limiting - Always protect against abuse
4. Ignoring logs - Monitor and act on warnings
5. No testing - Test configurations before deployment
6. Poor documentation - Document all custom configurations

• Configure OAuth2 Authentication
• Set up Rate Limiting
• Review Troubleshooting Guide
• Explore Usage Examples