A whole backend. One binary. Your VPS.

# Install the nelcota CLI
curl -fsSL https://raw.githubusercontent.com/Nelcota/Nelcota/main/scripts/install.sh \
  | NELCOTA_SKIP_DOCKER=1 sh

# Create an empty folder for your app
mkdir notes-app && cd notes-app

# Start PostgreSQL and the API, and leave it running
nelcota dev

# Write the migration: the notes table and its access rules
mkdir -p migrations src
cat > migrations/V1__notes.sql <<'SQL'
-- The table: each note belongs to the user who wrote it
CREATE TABLE public.notes (
    id    bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    owner uuid   NOT NULL DEFAULT auth.uid(),
    body  text   NOT NULL
);

-- Turn on row-level security for the table
ALTER TABLE public.notes ENABLE ROW LEVEL SECURITY;

-- Signed-in users may read and write the table...
GRANT SELECT, INSERT, UPDATE, DELETE
    ON public.notes
    TO authenticated;

-- ...but only the rows they own
CREATE POLICY notes_owner
    ON public.notes
    FOR ALL
    TO authenticated
    USING      (owner = auth.uid())
    WITH CHECK (owner = auth.uid());

-- A private bucket: each user writes in their own folder
INSERT INTO storage.buckets (id, public) VALUES ('files', false);

CREATE POLICY notes_files_owner
    ON storage.objects
    FOR ALL
    TO authenticated
    USING (
        bucket_id = 'files'
        AND (storage.foldername(name))[1] = auth.uid()::text
    )
    WITH CHECK (
        bucket_id = 'files'
        AND (storage.foldername(name))[1] = auth.uid()::text
    );
SQL

# Apply the migration and generate TypeScript types
nelcota migrate
nelcota types -o src/database.ts

# Create a user and keep their access token
TOKEN=$(curl -fsS -X POST http://127.0.0.1:8000/auth/v1/signup \
  -H 'content-type: application/json' \
  -d '{"email":"[email protected]","password":"a-development-password"}' \
  | jq -er '.access_token')

# Wait until the API sees the new table
for attempt in 1 2 3 4 5 6 7 8 9 10; do
  status=$(curl -s -o /dev/null -w '%{http_code}' \
    -H "authorization: Bearer $TOKEN" \
    http://127.0.0.1:8000/rest/v1/notes)
  [ "$status" = 200 ] && break
  sleep 0.2
done
[ "$status" = 200 ] || echo 'notes is not ready: check the nelcota dev terminal' >&2

# Insert a note as that user
curl -fsS -X POST http://127.0.0.1:8000/rest/v1/notes \
  -H "authorization: Bearer $TOKEN" \
  -H 'content-type: application/json' \
  -d '{"body":"My first note"}'

# Read the notes back: RLS returns only theirs
curl -fsS 'http://127.0.0.1:8000/rest/v1/notes?order=id.desc' \
  -H "authorization: Bearer $TOKEN"