9Router: evaluate an AI gateway without assuming unlimited access
Deploy 9Router with its custom server and a private provider boundary
Plan a pinned build, restricted listener and recoverable configuration without using a development command as production evidence.
What you will learn
- Preserve the intended entry point
- Restrict access before adding providers
- Roll back code and configuration deliberately
Before you start
- Basic command-line and configuration reading
- Ability to work in a disposable authorized environment
Design an evidence record that separates requested model, actual attempts and accepted response without retaining secrets.
Key takeaways
- The custom server is part of the deployment behavior.
- Provider and gateway credentials are different.
- Rollback needs protected configuration as well as code.
Preserve the intended entry point
The inspected build script uses next build --webpack and a postbuild asset-copy step. The start script invokes custom-server.js. That wrapper supplies request handling not present in a bare next start or next dev launch.
Pin the source revision and dependency lockfile used for the build. Record build output and the actual listener. Package version alone does not establish that the wrapper and standalone assets deployed together correctly.
Restrict access before adding providers
Keep the initial gateway local or on an approved private network. If a reverse proxy is added, review its placement and header rewriting with the wrapper’s loopback-trust rule. Do not expose a dashboard or model gateway without authentication and an access policy.
Use only authorized provider credentials, stored privately. A gateway account and upstream provider account have different roles. Review logging and configuration backups so a local routing convenience does not duplicate secrets into public artifacts.
Roll back code and configuration deliberately
Retain the old build and a protected configuration snapshot before upgrading. Test one synthetic request, streaming if required and an intentional provider failure in an isolated environment. Preserve data compatibility when restoring an older build.
If admission or routing behaves unexpectedly, stop new traffic and restore the known configuration through a reviewed plan. We did not build or deploy 9Router itself; these are acceptance requirements for the reader’s pilot.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Pin source and dependencies and retain the custom entry point.
- 2
Restrict listener and review proxy behavior.
- 3
Test and preserve a previous build/configuration pair.
Copy-ready example
{
"deploymentProposal": true,
"entry": "custom-server.js",
"publicListener": false,
"approvedProviders": [],
"previousBuildRetained": true,
"liveGatewayTested": false
}Frequently asked questions
Can I use next dev as production deployment?
The inspected production path uses the custom server; development startup does not establish equivalent handling.
Does a private gateway remove provider obligations?
No. Account permissions and approved data handling remain necessary.
Sources
- 9Router / package.jsonSource checked 2026-09-18
- 9Router / custom-server.jsSource checked 2026-09-18
- 9Router / README.mdSource checked 2026-09-18