new stuff and bugfixes

README.md

···
 # 🚃 boxcar
 
-A production-ready, opinionated Rails 7+ application template with 24 integrated modules for authentication, authorization, monitoring, and more.
+A production-ready, opinionated Rails 7+ application template with 33 integrated modules for authentication, authorization, monitoring, and more.
 
 Inspired by [@nora](https://github.com/24c02)'s [thirdrail](https://github.com/24c02/thirdrail).
 
···
 | Category | Modules |
 |----------|---------|
 | **Auth & Security** | Custom auth, Pundit, Lockbox encryption, rate limiting |
-| **Admin Dashboards** | Blazer, Flipper, Rails Performance, Mission Control |
+| **Admin Dashboards** | Blazer, Flipper, Rails Performance, GoodJob, PgHero |
 | **Data Management** | Soft deletes, audit trails, friendly URLs, full-text search |
 | **Observability** | Health checks, analytics, console auditing, StatsD metrics |
-| **Infrastructure** | Redis, PostgreSQL multi-db, Solid Queue, Tailwind CSS |
+| **Infrastructure** | Redis, PostgreSQL multi-db, GoodJob, Tailwind CSS |
 
 ## Quick Start
 
···
 - **BlindIndex** — Search encrypted fields without decryption
 - **InvisibleCaptcha** — Honeypot spam protection
 - **Strong Migrations** — Prevents dangerous migrations in production
+- **CSP & CORS** — Content Security Policy and cross-origin headers
+- **Security Scanning** — Bundler-audit and Brakeman in CI
 
 ### Admin Dashboards
 
···
 | Blazer | `/admin/blazer` | admin+ | SQL-based analytics |
 | Flipper | `/admin/flipper` | super_admin+ | Feature flags |
 | Performance | `/admin/performance` | admin+ | Request monitoring |
-| Jobs | `/admin/jobs` | admin+ | Background job dashboard |
+| Jobs | `/admin/jobs` | admin+ | GoodJob dashboard |
+| PgHero | `/admin/pghero` | admin+ | PostgreSQL insights |
 | Console Audits | `/admin/console_audits` | super_admin+ | Rails console access logs |
 
 ### Data Features
···
 
 ### Background Jobs
 
-- **Solid Queue** — Database-backed job processing (no Redis required for jobs)
-- **Mission Control** — Web UI for job monitoring and management
+- **GoodJob** — PostgreSQL-backed job processing with built-in dashboard
+- **Recurring Jobs** — Cron-like scheduling built-in
+- **Job Preservation** — Debug failed jobs with full history
 
 ### Monitoring & Analytics
 
···
 - **Ahoy Analytics** — Visit and event tracking with email integration
 - **StatsD Metrics** — Request timing, custom gauges, Datadog-ready
 - **Console1984** — Encrypted audit logs for Rails console access
+- **Lograge** — Structured JSON logging with request ID tracing
+- **Logstop** — Automatic PII filtering from logs
 
 ### Infrastructure
 
 - **PostgreSQL** — Multi-database setup (primary, queue, cache, cable)
 - **Redis** — Sessions (db 2), cache (db 1), rate limiting (db 5)
 - **Tailwind CSS** — Pre-configured and ready to customize
+- **IdentityCache** — Blob-level caching for ActiveRecord
+- **PgHero** — PostgreSQL performance insights
+
+### Email
+
+- **Transactional Templates** — Welcome, password reset, email confirmation
+- **Email Previews** — Preview emails in development
+- **Premailer** — Automatic CSS inlining for email clients
+- **Mailkick** — Unsubscribe management
 
 ## Included Concerns
 

modules/admin_routes.rb

···
     # Rails Performance Dashboard (admin or above)
     mount RailsPerformance::Engine, at: 'performance', constraints: AdminConstraint.new(:rails_performance?) if defined?(RailsPerformance)
 
-    # Mission Control Jobs Dashboard (admin or above)
-    mount MissionControl::Jobs::Engine, at: 'jobs', constraints: AdminConstraint.new(:jobs?) if defined?(MissionControl::Jobs)
+    # GoodJob Dashboard (admin or above)
+    mount GoodJob::Engine, at: 'jobs', constraints: AdminConstraint.new(:jobs?) if defined?(GoodJob)
 
     # Console Audits (super_admin or above)
     mount Audits1984::Engine, at: 'console_audits', constraints: AdminConstraint.new(:console_audits?) if defined?(Audits1984)
+
+    # PgHero PostgreSQL Dashboard (admin or above)
+    mount PgHero::Engine, at: 'pghero', constraints: AdminConstraint.new(:pghero?) if defined?(PgHero)
 
     resources :users
   end

modules/analytics.rb

···
 end
 
 say '   Creating Ahoy initializer...', :cyan
-file 'config/initializers/ahoy.rb', <<~RUBY
+file 'config/initializers/ahoy.rb', <<~RUBY, force: true
   # frozen_string_literal: true
 
   class Ahoy::Store < Ahoy::DatabaseStore

modules/auth.rb

···
 
 gem 'bcrypt', '~> 3.1'
 
-say '   Generating User model...', :cyan
-generate :model, 'User email:string:uniq password_digest:string role:integer'
+# Generate models after bundle install
+after_bundle do
+  say '   Generating User model...', :cyan
+  generate :model, 'User email:string:uniq password_digest:string role:integer'
 
-# Add index for email lookup
-begin
-  inject_into_file "db/migrate/#{Dir.entries('db/migrate').grep(/create_users/).first}",
-                   after: "t.string :email\n" do
-  "      t.index :email, unique: true\n"
-end
-rescue StandardError
-  nil
+  say '   Generating Session model...', :cyan
+  generate :model, 'Session user:references token:string:uniq ip_address:string user_agent:string'
 end
 
 # User model with has_secure_password and roles
···
     end
   end
 RUBY
-
-say '   Generating Session model...', :cyan
-generate :model, 'Session user:references token:string:uniq ip_address:string user_agent:string'
 
 file 'app/models/session.rb', <<~RUBY, force: true
   class Session < ApplicationRecord

modules/blazer.rb

···
 RUBY
 
 say '   Creating Blazer config...', :cyan
-file 'config/blazer.yml', <<~YAML
+file 'config/blazer.yml', <<~YAML, force: true
   # Blazer configuration
   # https://github.com/ankane/blazer
 

modules/caching.rb

···
+# frozen_string_literal: true
+
+say 'Setting up caching strategies...', :green
+
+gem 'identity_cache'
+gem 'cityhash' # Required for identity_cache
+
+say '   Configuring IdentityCache...', :cyan
+initializer 'identity_cache.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # IdentityCache - Blob level caching for Active Record
+  # See: https://github.com/Shopify/identity_cache
+
+  IdentityCache.logger = Rails.logger
+  IdentityCache.cache_backend = Rails.cache
+RUBY
+
+say '   Creating Cacheable concern...', :cyan
+file 'app/models/concerns/cacheable.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Include in models for identity caching
+  #
+  # Usage:
+  #   class User < ApplicationRecord
+  #     include Cacheable
+  #
+  #     cache_index :email
+  #     cache_has_many :posts
+  #   end
+  #
+  #   User.fetch(1)              # Cached fetch by id
+  #   User.fetch_by_email(email) # Cached fetch by index
+  #
+  module Cacheable
+    extend ActiveSupport::Concern
+
+    included do
+      include IdentityCache
+    end
+
+    class_methods do
+      # Expire cache when record is updated
+      def expire_cache_for(record)
+        record.expire_cache if record.respond_to?(:expire_cache)
+      end
+    end
+  end
+RUBY
+
+say '   Creating CacheHelper...', :cyan
+file 'app/helpers/cache_helper.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Helper methods for view caching
+  #
+  # Russian Doll Caching:
+  #   The key insight is that when a nested object changes,
+  #   only its cache (and parent caches) are invalidated.
+  #
+  # Example view structure:
+  #   <% cache @project do %>
+  #     <%= render @project.tasks %>
+  #   <% end %>
+  #
+  #   # _task.html.erb
+  #   <% cache task do %>
+  #     <%= task.name %>
+  #     <%= render task.comments %>
+  #   <% end %>
+  #
+  module CacheHelper
+    # Cache with automatic expiry based on record updated_at
+    # Also includes a version number for manual cache busting
+    #
+    # Usage:
+    #   <% cache_with_version @user, 'v2' do %>
+    #     ...
+    #   <% end %>
+    #
+    def cache_with_version(record, version = 'v1', options = {}, &block)
+      cache([version, record], options, &block)
+    end
+
+    # Cache a collection with automatic key generation
+    # Useful for lists that change frequently
+    #
+    # Usage:
+    #   <% cache_collection @users do |user| %>
+    #     <%= render user %>
+    #   <% end %>
+    #
+    def cache_collection(collection, options = {}, &block)
+      cache([collection.cache_key_with_version, collection.size], options, &block)
+    end
+
+    # Time-based cache for content that should refresh periodically
+    #
+    # Usage:
+    #   <% cache_for 5.minutes, 'dashboard_stats' do %>
+    #     ...
+    #   <% end %>
+    #
+    def cache_for(duration, key, options = {}, &block)
+      expires_key = (Time.current.to_i / duration.to_i)
+      cache([key, expires_key], options, &block)
+    end
+  end
+RUBY
+
+say '   Creating CacheWarmer job...', :cyan
+file 'app/jobs/cache_warmer_job.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Warm caches for frequently accessed data
+  #
+  # Schedule this job to run periodically:
+  #   CacheWarmerJob.perform_later
+  #
+  # Or warm specific caches:
+  #   CacheWarmerJob.perform_later(caches: ['users', 'settings'])
+  #
+  class CacheWarmerJob < ApplicationJob
+    queue_as :low
+
+    def perform(caches: nil)
+      warmers = caches || default_warmers
+      warmers.each { |warmer| send("warm_\#{warmer}") }
+    end
+
+    private
+
+    def default_warmers
+      %w[settings]
+    end
+
+    # Add your cache warming methods here
+    #
+    # def warm_users
+    #   User.active.find_each do |user|
+    #     Rails.cache.fetch(user.cache_key_with_version) { user }
+    #   end
+    # end
+
+    def warm_settings
+      # Example: warm application settings
+      # AppConfig.all.each do |config|
+      #   Rails.cache.fetch(['app_config', config.key]) { config.value }
+      # end
+    end
+  end
+RUBY
+
+say '   Documenting caching patterns...', :cyan
+file 'docs/caching.md', <<~MARKDOWN
+  # Caching Strategies
+
+  ## Fragment Caching (Views)
+
+  Basic fragment cache:
+  ```erb
+  <% cache @user do %>
+    <%= @user.name %>
+  <% end %>
+  ```
+
+  ## Russian Doll Caching
+
+  Nested caches that auto-expire:
+  ```erb
+  <% cache @project do %>
+    <h1><%= @project.name %></h1>
+    <%= render @project.tasks %>
+  <% end %>
+
+  <!-- _task.html.erb -->
+  <% cache task do %>
+    <%= task.name %>
+  <% end %>
+  ```
+
+  **Important:** Use `touch: true` on associations:
+  ```ruby
+  class Task < ApplicationRecord
+    belongs_to :project, touch: true
+  end
+  ```
+
+  ## Model Caching (IdentityCache)
+
+  ```ruby
+  class User < ApplicationRecord
+    include Cacheable
+
+    cache_index :email
+    cache_has_many :posts, embed: true
+  end
+
+  # Usage
+  User.fetch(1)                    # Cached
+  User.fetch_by_email('[e-mail]')   # Cached
+  user.fetch_posts                 # Cached with user
+  ```
+
+  ## Low-Level Caching
+
+  ```ruby
+  Rails.cache.fetch('expensive_operation', expires_in: 1.hour) do
+    ExpensiveService.call
+  end
+  ```
+
+  ## Cache Warming
+
+  ```ruby
+  # Run periodically
+  CacheWarmerJob.perform_later
+
+  # Or specific caches
+  CacheWarmerJob.perform_later(caches: ['users'])
+  ```
+MARKDOWN
+
+say 'Caching strategies configured!', :green
+say '   Use `include Cacheable` in models for identity caching', :cyan
+say '   See docs/caching.md for patterns', :cyan

modules/console1984.rb

···
 gem 'audits1984'
 
 after_bundle do
-  say '   Running Console1984 installer...', :cyan
-  rails_command 'console1984:install'
+  say '   Running Console1984 migrations installer...', :cyan
+  rails_command 'console1984:install:migrations'
 
-  say '   Running Audits1984 installer...', :cyan
-  rails_command 'audits1984:install'
+  say '   Running Audits1984 migrations installer...', :cyan
+  rails_command 'audits1984:install:migrations'
 end
 
 say '   Creating Console1984 initializer...', :cyan

modules/credentials.rb

···
 
 say 'Setting up credentials...', :green
 
-# Initialize credentials for each environment
-%w[development staging production].each do |env|
-  say "   Creating #{env} credentials...", :cyan
-  run "EDITOR='echo' bin/rails credentials:edit --environment #{env}", abort_on_failure: false
+# Initialize credentials for each environment (after bundle)
+after_bundle do
+  say '   Creating environment credentials...', :cyan
+  %w[development staging production].each do |env|
+    say "      #{env}...", :cyan
+    run "EDITOR='echo' bin/rails credentials:edit --environment #{env}", abort_on_failure: false
+  end
 end
 
 # Create credentials example file

modules/csp.rb

···
+# frozen_string_literal: true
+
+say 'Setting up security hardening...', :green
+
+gem 'rack-cors'
+# bundler-audit included by Rails 8
+
+say '   Configuring Content Security Policy...', :cyan
+initializer 'content_security_policy.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Define an application-wide content security policy
+  # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+
+  Rails.application.configure do
+    config.content_security_policy do |policy|
+      policy.default_src :self
+      policy.font_src    :self, :data, 'https://fonts.gstatic.com'
+      policy.img_src     :self, :data, :blob
+      policy.object_src  :none
+      policy.script_src  :self
+      policy.style_src   :self, :unsafe_inline, 'https://fonts.googleapis.com'
+      policy.frame_ancestors :self
+      policy.base_uri    :self
+      policy.form_action :self
+
+      # Allow connections to same origin and websockets
+      policy.connect_src :self, :wss
+
+      # Report violations to your error tracking service
+      # policy.report_uri '/csp-report'
+    end
+
+    # Generate nonce for inline scripts/styles
+    # Use <%= csp_meta_tag %> in your layout and
+    # <%= javascript_tag nonce: true %> for inline scripts
+    config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+    config.content_security_policy_nonce_directives = %w[script-src style-src]
+
+    # Report CSP violations without enforcing (useful for rollout)
+    # config.content_security_policy_report_only = true
+  end
+RUBY
+
+say '   Configuring CORS...', :cyan
+initializer 'cors.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Configure Cross-Origin Resource Sharing (CORS)
+  # See: https://github.com/cyu/rack-cors
+
+  Rails.application.config.middleware.insert_before 0, Rack::Cors do
+    allow do
+      # Allow requests from your frontend domain
+      origins Rails.env.development? ? 'localhost:3000' : ENV.fetch('CORS_ORIGINS', '').split(',')
+
+      resource '/api/*',
+               headers: :any,
+               methods: %i[get post put patch delete options head],
+               credentials: true,
+               max_age: 86_400
+
+      # Health checks should be accessible
+      resource '/health*',
+               headers: :any,
+               methods: [:get]
+    end
+  end
+RUBY
+
+say '   Adding security headers...', :cyan
+initializer 'secure_headers.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Additional security headers configured via middleware
+  Rails.application.config.action_dispatch.default_headers = {
+    'X-Frame-Options' => 'SAMEORIGIN',
+    'X-Content-Type-Options' => 'nosniff',
+    'X-XSS-Protection' => '0', # Disabled as per modern best practices
+    'X-Permitted-Cross-Domain-Policies' => 'none',
+    'Referrer-Policy' => 'strict-origin-when-cross-origin',
+    'Permissions-Policy' => 'accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()'
+  }
+RUBY
+
+say '   Adding CSP meta tag to layout...', :cyan
+inject_into_file 'app/views/layouts/application.html.erb', after: "<%= csrf_meta_tags %>\n" do
+  "    <%= csp_meta_tag %>\n"
+end
+
+say 'Security hardening configured!', :green
+say '   CSP headers enabled (review policy for your needs)', :cyan
+say '   CORS configured for API routes', :cyan
+say '   Run `bundle audit` to check for vulnerabilities', :yellow

modules/database.rb

···
 
 say 'Configuring PostgreSQL with multi-database setup...', :green
 
+gem 'pg'
+
 say '   Creating database.yml...', :cyan
 file 'config/database.yml', <<~YAML, force: true
   # PostgreSQL for all environments (with Row Level Security support)

modules/development_tools.rb

···
   gem 'actual_db_schema'
   gem 'annotaterb'
   gem 'letter_opener_web'
+  gem 'rack-mini-profiler', require: false
 end
+
+# Rack Mini Profiler configuration
+initializer 'rack_mini_profiler.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  if defined?(Rack::MiniProfiler) && Rails.env.development?
+    require 'rack-mini-profiler'
+    Rack::MiniProfilerRails.initialize!(Rails.application)
+  end
+RUBY
 
 # Bullet configuration for N+1 query detection
 initializer 'bullet.rb', <<~RUBY

modules/email.rb

···
+# frozen_string_literal: true
+
+say 'Setting up email infrastructure...', :green
+
+gem 'premailer-rails' # Inline CSS for email clients
+
+say '   Configuring Premailer...', :cyan
+initializer 'premailer.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  Premailer::Rails.config.merge!(
+    preserve_styles: true,
+    remove_ids: false,
+    remove_classes: false
+  )
+RUBY
+
+say '   Creating UserMailer...', :cyan
+file 'app/mailers/user_mailer.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  class UserMailer < ApplicationMailer
+    def welcome(user)
+      @user = user
+      @login_url = sign_in_url
+
+      mail(
+        to: @user.email,
+        subject: "Welcome to \#{Rails.application.class.module_parent_name}"
+      )
+    end
+
+    def password_reset(user, token)
+      @user = user
+      @token = token
+      @reset_url = edit_password_reset_url(token: @token)
+
+      mail(
+        to: @user.email,
+        subject: 'Reset your password'
+      )
+    end
+
+    def email_confirmation(user, token)
+      @user = user
+      @token = token
+      @confirm_url = confirm_email_url(token: @token)
+
+      mail(
+        to: @user.email,
+        subject: 'Confirm your email address'
+      )
+    end
+  end
+RUBY
+
+say '   Creating email layout...', :cyan
+file 'app/views/layouts/mailer.html.erb', <<~ERB, force: true
+  <!DOCTYPE html>
+  <html>
+    <head>
+      <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <style>
+        /* Base styles */
+        body {
+          font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+          font-size: 16px;
+          line-height: 1.5;
+          color: #333333;
+          background-color: #f5f5f5;
+          margin: 0;
+          padding: 0;
+        }
+
+        /* Email container */
+        .email-wrapper {
+          max-width: 600px;
+          margin: 0 auto;
+          padding: 20px;
+        }
+
+        .email-content {
+          background-color: #ffffff;
+          border-radius: 8px;
+          padding: 40px;
+          box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
+        }
+
+        /* Header */
+        .email-header {
+          text-align: center;
+          margin-bottom: 30px;
+        }
+
+        .email-header h1 {
+          margin: 0;
+          font-size: 24px;
+          color: #111111;
+        }
+
+        /* Body */
+        .email-body {
+          margin-bottom: 30px;
+        }
+
+        .email-body p {
+          margin: 0 0 16px 0;
+        }
+
+        /* Button */
+        .button {
+          display: inline-block;
+          padding: 12px 24px;
+          background-color: #2563eb;
+          color: #ffffff !important;
+          text-decoration: none;
+          border-radius: 6px;
+          font-weight: 600;
+        }
+
+        .button:hover {
+          background-color: #1d4ed8;
+        }
+
+        /* Footer */
+        .email-footer {
+          text-align: center;
+          font-size: 14px;
+          color: #666666;
+          border-top: 1px solid #eeeeee;
+          padding-top: 20px;
+          margin-top: 30px;
+        }
+
+        .email-footer a {
+          color: #2563eb;
+        }
+      </style>
+    </head>
+    <body>
+      <div class="email-wrapper">
+        <div class="email-content">
+          <%= yield %>
+        </div>
+        <div class="email-footer">
+          <p>&copy; <%= Date.current.year %> <%= Rails.application.class.module_parent_name %>. All rights reserved.</p>
+          <p>
+            <% if @user.respond_to?(:email) %>
+              <a href="<%= mailkick_unsubscribe_url %>">Unsubscribe</a>
+            <% end %>
+          </p>
+        </div>
+      </div>
+    </body>
+  </html>
+ERB
+
+say '   Creating welcome email template...', :cyan
+file 'app/views/user_mailer/welcome.html.erb', <<~ERB
+  <div class="email-header">
+    <h1>Welcome!</h1>
+  </div>
+
+  <div class="email-body">
+    <p>Hi <%= @user.email %>,</p>
+
+    <p>Thanks for signing up! We're excited to have you on board.</p>
+
+    <p>To get started, click the button below to sign in to your account:</p>
+
+    <p style="text-align: center; margin: 30px 0;">
+      <a href="<%= @login_url %>" class="button">Sign In</a>
+    </p>
+
+    <p>If you have any questions, just reply to this email - we're always happy to help.</p>
+  </div>
+ERB
+
+say '   Creating password reset template...', :cyan
+file 'app/views/user_mailer/password_reset.html.erb', <<~ERB
+  <div class="email-header">
+    <h1>Reset Your Password</h1>
+  </div>
+
+  <div class="email-body">
+    <p>Hi <%= @user.email %>,</p>
+
+    <p>We received a request to reset your password. Click the button below to choose a new one:</p>
+
+    <p style="text-align: center; margin: 30px 0;">
+      <a href="<%= @reset_url %>" class="button">Reset Password</a>
+    </p>
+
+    <p>This link will expire in 2 hours.</p>
+
+    <p>If you didn't request this, you can safely ignore this email. Your password won't be changed.</p>
+  </div>
+ERB
+
+say '   Creating email confirmation template...', :cyan
+file 'app/views/user_mailer/email_confirmation.html.erb', <<~ERB
+  <div class="email-header">
+    <h1>Confirm Your Email</h1>
+  </div>
+
+  <div class="email-body">
+    <p>Hi <%= @user.email %>,</p>
+
+    <p>Please confirm your email address by clicking the button below:</p>
+
+    <p style="text-align: center; margin: 30px 0;">
+      <a href="<%= @confirm_url %>" class="button">Confirm Email</a>
+    </p>
+
+    <p>This link will expire in 24 hours.</p>
+
+    <p>If you didn't create an account, you can safely ignore this email.</p>
+  </div>
+ERB
+
+say '   Creating text email templates...', :cyan
+file 'app/views/user_mailer/welcome.text.erb', <<~ERB
+  Welcome!
+
+  Hi <%= @user.email %>,
+
+  Thanks for signing up! We're excited to have you on board.
+
+  To get started, visit: <%= @login_url %>
+
+  If you have any questions, just reply to this email.
+ERB
+
+file 'app/views/user_mailer/password_reset.text.erb', <<~ERB
+  Reset Your Password
+
+  Hi <%= @user.email %>,
+
+  We received a request to reset your password. Visit the link below to choose a new one:
+
+  <%= @reset_url %>
+
+  This link will expire in 2 hours.
+
+  If you didn't request this, you can safely ignore this email.
+ERB
+
+file 'app/views/user_mailer/email_confirmation.text.erb', <<~ERB
+  Confirm Your Email
+
+  Hi <%= @user.email %>,
+
+  Please confirm your email address by visiting:
+
+  <%= @confirm_url %>
+
+  This link will expire in 24 hours.
+ERB
+
+say '   Creating email previews...', :cyan
+file 'test/mailers/previews/user_mailer_preview.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Preview emails at http://localhost:3000/rails/mailers/user_mailer
+  class UserMailerPreview < ActionMailer::Preview
+    def welcome
+      user = User.first || OpenStruct.new(email: '[e-mail]')
+      UserMailer.welcome(user)
+    end
+
+    def password_reset
+      user = User.first || OpenStruct.new(email: '[e-mail]')
+      UserMailer.password_reset(user, 'sample_token_123')
+    end
+
+    def email_confirmation
+      user = User.first || OpenStruct.new(email: '[e-mail]')
+      UserMailer.email_confirmation(user, 'sample_token_123')
+    end
+  end
+RUBY
+
+say 'Email infrastructure configured!', :green
+say '   Preview emails at /rails/mailers in development', :cyan
+say '   Or use LetterOpener at /letter_opener', :cyan

modules/github.rb

···
 
 empty_directory '.github/workflows'
 
-# Migration index checker - ensures foreign keys are indexed
+say '   Adding migration index checker...', :cyan
 file '.github/workflows/check-indexes.yml', <<~YAML
   name: Check Indexes
   on:
···
 
         - name: Check Migration Indexes
           uses: speedshop/ids_must_be_indexed@v1.2.1
+YAML
+
+say '   Adding security scanning...', :cyan
+file '.github/workflows/security.yml', <<~YAML
+  name: Security
+
+  on:
+    push:
+      branches: [main]
+    pull_request:
+      branches: [main]
+    schedule:
+      - cron: '0 6 * * 1' # Weekly on Monday at 6am
+
+  jobs:
+    bundler-audit:
+      name: Bundler Audit
+      runs-on: ubuntu-latest
+      steps:
+        - uses: actions/checkout@v4
+
+        - name: Set up Ruby
+          uses: ruby/setup-ruby@v1
+          with:
+            bundler-cache: true
+
+        - name: Run bundler-audit
+          run: |
+            gem install bundler-audit
+            bundle audit check --update
+
+    brakeman:
+      name: Brakeman
+      runs-on: ubuntu-latest
+      steps:
+        - uses: actions/checkout@v4
+
+        - name: Set up Ruby
+          uses: ruby/setup-ruby@v1
+          with:
+            bundler-cache: true
+
+        - name: Run Brakeman
+          run: |
+            gem install brakeman
+            brakeman -q --no-pager
 YAML
 
 say 'GitHub workflows configured!', :green

modules/good_job.rb

···
+# frozen_string_literal: true
+
+say 'Setting up GoodJob for background processing...', :green
+
+gem 'good_job'
+
+say '   Configuring GoodJob...', :cyan
+initializer 'good_job.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  Rails.application.configure do
+    # Use GoodJob as the Active Job adapter
+    config.active_job.queue_adapter = :good_job
+
+    config.good_job = {
+      # Execution mode (:async, :external, :inline)
+      # :async - runs jobs in the web process (good for low-volume)
+      # :external - runs jobs in a separate process (recommended for production)
+      # :inline - runs jobs immediately (good for testing)
+      execution_mode: Rails.env.production? ? :external : :async,
+
+      # Maximum threads per process
+      max_threads: ENV.fetch('GOOD_JOB_MAX_THREADS', 5).to_i,
+
+      # Poll interval for checking new jobs (in seconds)
+      poll_interval: ENV.fetch('GOOD_JOB_POLL_INTERVAL', 5).to_i,
+
+      # Queues to process (priority order)
+      queues: ENV.fetch('GOOD_JOB_QUEUES', '*'),
+
+      # Cron-like recurring jobs
+      enable_cron: true,
+      cron: {
+        # Example: cleanup old sessions daily at 3am
+        # cleanup_sessions: {
+        #   cron: '0 3 * * *',
+        #   class: 'CleanupSessionsJob',
+        #   description: 'Remove expired sessions'
+        # },
+
+        # Example: send weekly digest every Monday at 9am
+        # weekly_digest: {
+        #   cron: '0 9 * * 1',
+        #   class: 'WeeklyDigestJob',
+        #   description: 'Send weekly email digest'
+        # }
+      },
+
+      # Preserve job records for debugging (default: 14 days)
+      preserve_job_records: true,
+      cleanup_preserved_jobs_before_seconds_ago: 14.days.to_i,
+
+      # Dashboard configuration
+      smaller_number_is_higher_priority: true
+    }
+  end
+RUBY
+
+after_bundle do
+  say '   Installing GoodJob...', :cyan
+  rails_command 'good_job:install'
+
+  say '   Adding GoodJob to Procfile.dev...', :cyan
+  append_to_file 'Procfile.dev', "jobs: bundle exec good_job start\n"
+end
+
+say '   Creating example recurring job...', :cyan
+file 'app/jobs/cleanup_job.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Example recurring job for cleanup tasks
+  # Configure schedule in config/initializers/good_job.rb
+  #
+  # cron: {
+  #   cleanup: {
+  #     cron: '0 4 * * *',  # 4am daily
+  #     class: 'CleanupJob'
+  #   }
+  # }
+  #
+  class CleanupJob < ApplicationJob
+    queue_as :low
+
+    def perform
+      cleanup_expired_sessions
+      cleanup_old_versions
+      cleanup_orphaned_records
+    end
+
+    private
+
+    def cleanup_expired_sessions
+      # Remove sessions older than 30 days
+      Session.where('created_at < ?', 30.days.ago).delete_all
+    end
+
+    def cleanup_old_versions
+      # Remove PaperTrail versions older than 90 days (if using paper_trail)
+      return unless defined?(PaperTrail)
+
+      PaperTrail::Version.where('created_at < ?', 90.days.ago).delete_all
+    end
+
+    def cleanup_orphaned_records
+      # Add your cleanup logic here
+    end
+  end
+RUBY
+
+say 'GoodJob configured!', :green
+say '   Dashboard at /admin/jobs', :cyan
+say '   Run jobs: bundle exec good_job start', :cyan
+say '   Add cron jobs in config/initializers/good_job.rb', :cyan

modules/logging.rb

···
+# frozen_string_literal: true
+
+say 'Setting up structured logging...', :green
+
+gem 'lograge'
+gem 'logstop'
+
+say '   Creating Lograge initializer...', :cyan
+initializer 'lograge.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  return unless defined?(Lograge)
+
+  Rails.application.configure do
+    # Enable lograge for structured logging
+    config.lograge.enabled = true
+
+    # Use JSON format in production for log aggregation
+    config.lograge.formatter = if Rails.env.production?
+                                  Lograge::Formatters::Json.new
+                                else
+                                  Lograge::Formatters::KeyValue.new
+                                end
+
+    # Include request_id for tracing across services
+    config.lograge.custom_options = lambda do |event|
+      {
+        request_id: event.payload[:request_id],
+        user_id: event.payload[:user_id],
+        ip: event.payload[:ip],
+        host: event.payload[:host]
+      }.compact
+    end
+
+    # Add custom data to the payload
+    config.lograge.custom_payload do |controller|
+      {
+        request_id: controller.request.request_id,
+        user_id: controller.try(:current_user)&.id,
+        ip: controller.request.remote_ip,
+        host: controller.request.host
+      }
+    end
+
+    # Keep original Rails logs in development
+    config.lograge.keep_original_rails_log = Rails.env.development?
+  end
+RUBY
+
+say '   Creating Logstop initializer...', :cyan
+initializer 'logstop.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Logstop filters sensitive data from logs
+  # By default it filters: email, phone, credit card, SSN, IP addresses
+
+  if defined?(Logstop)
+    Logstop.guard(Rails.logger)
+
+    # Add custom scrubbers for application-specific sensitive data
+    # Logstop.scrub(pattern, replacement)
+    #
+    # Example: Scrub API keys
+    # Logstop.scrub(/api_key=\\w+/, 'api_key=[FILTERED]')
+  end
+RUBY
+
+say 'Structured logging configured!', :green
+say '   Logs include request_id for tracing', :cyan
+say '   PII is automatically filtered by Logstop', :cyan

modules/metrics.rb

···
 file 'config/initializers/statsd.rb', <<~RUBY
   # frozen_string_literal: true
 
-  StatsD.backend = if Rails.env.production?
-    StatsD::Instrument::Backends::UDPBackend.new(
-      ENV.fetch('STATSD_ADDR', 'localhost:8125'),
-      :datadog
-    )
-  else
-    StatsD::Instrument::Backends::LoggerBackend.new(Rails.logger)
-  end
+  return unless defined?(StatsD)
 
-  StatsD.prefix = Rails.application.class.module_parent_name.underscore
-  StatsD.default_tags = [
-    "env:\#{Rails.env}",
-    "app:\#{Rails.application.class.module_parent_name.underscore}"
-  ]
+  # Configure StatsD client
+  # In production, point to your StatsD server (e.g., Datadog agent)
+  # In development, logs to Rails logger
+  StatsD.singleton_client = StatsD::Instrument::Client.new(
+    sink: if Rails.env.production?
+            StatsD::Instrument::UDPSink.new(
+              ENV.fetch('STATSD_HOST', 'localhost'),
+              ENV.fetch('STATSD_PORT', 8125).to_i
+            )
+          else
+            StatsD::Instrument::LogSink.new(Rails.logger)
+          end,
+    prefix: Rails.application.class.module_parent_name.underscore,
+    default_tags: [
+      "env:\#{Rails.env}",
+      "app:\#{Rails.application.class.module_parent_name.underscore}"
+    ]
+  )
 RUBY
 
 say '   Creating Metrics module...', :cyan
···
   end
 RUBY
 
-say '   Adding middleware to application...', :cyan
-inject_into_file 'config/application.rb', after: "class Application < Rails::Application\n" do
-  "    config.middleware.use RequestMetrics\n"
-end
+say '   Creating middleware initializer...', :cyan
+initializer 'request_metrics.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  require Rails.root.join('app/middleware/request_metrics')
+
+  Rails.application.config.middleware.use RequestMetrics
+RUBY
 
 say '   Adding to .env.development...', :cyan
-append_to_file '.env.development', "STATSD_ADDR=localhost:8125\n"
+append_to_file '.env.development', "STATSD_HOST=localhost\nSTATSD_PORT=8125\n"
 
 say 'StatsD metrics configured!', :green
 say '   Use Metrics.increment, .gauge, .measure, .histogram', :cyan
 say '   Request metrics automatically tracked', :cyan
-say '   Set STATSD_ADDR in production', :yellow
+say '   Set STATSD_HOST/STATSD_PORT in production', :yellow

modules/pghero.rb

···
+# frozen_string_literal: true
+
+say 'Setting up PgHero...', :green
+
+gem 'pghero'
+
+say '   Configuring PgHero...', :cyan
+initializer 'pghero.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # PgHero - PostgreSQL insights
+  # Dashboard: /admin/pghero
+
+  ENV['PGHERO_USERNAME'] ||= Rails.application.credentials.dig(:pghero, :username) || 'admin'
+  ENV['PGHERO_PASSWORD'] ||= Rails.application.credentials.dig(:pghero, :password) || 'admin'
+RUBY
+
+after_bundle do
+  say '   Generating PgHero config...', :cyan
+  rails_command 'generate pghero:config'
+
+  say '   Generating PgHero query stats migration...', :cyan
+  rails_command 'generate pghero:query_stats'
+end
+
+say 'PgHero configured!', :green
+say '   Dashboard will be mounted at /admin/pghero', :cyan
+say '   Enable pg_stat_statements in PostgreSQL for query insights', :yellow

modules/pundit.rb

···
       user&.super_admin_or_above?
     end
 
+    def pghero?
+      user&.admin_or_above?
+    end
+
     def access_admin_endpoints?
       user&.admin_or_above?
     end

modules/rails_performance.rb

···
 
 gem 'rails_performance'
 
-after_bundle do
-  say '   Running Rails Performance installer...', :cyan
-  rails_command 'rails_performance:install'
-end
+# Note: rails_performance doesn't have an install generator
+# We create the initializer manually below
 
 say '   Creating Rails Performance initializer...', :cyan
 file 'config/initializers/rails_performance.rb', <<~RUBY

modules/redis.rb

···
   # frozen_string_literal: true
 
   # Use Redis for session storage
-  Rails.application.config.session_store :redis_store,
-    servers: ENV.fetch('REDIS_URL') { 'redis://localhost:6379/2/session' },
-    expire_after: 90.minutes,
+  Rails.application.config.session_store :redis_session_store,
     key: "_\#{Rails.application.class.module_parent_name.underscore}_session",
-    threadsafe: true,
-    signed: true
+    redis: {
+      expire_after: 90.minutes,
+      key_prefix: 'session:',
+      url: ENV.fetch('REDIS_URL') { 'redis://localhost:6379/2' }
+    }
 RUBY
 
 say '   Configuring Rack::Attack...', :cyan
···
 
   # Configure Rack Attack for rate limiting
   class Rack::Attack
-    # Use Redis for Rack Attack storage
-    Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(
-      url: ENV.fetch('REDIS_URL') { 'redis://localhost:6379/5' }
-    )
+    # Use Rails.cache (backed by Redis in production)
+    Rack::Attack.cache.store = Rails.cache
 
     # Throttle all requests by IP (300 req/5 minutes)
     throttle('req/ip', limit: 300, period: 5.minutes) do |req|

modules/seo.rb

···
+# frozen_string_literal: true
+
+say 'Setting up SEO & navigation helpers...', :green
+
+gem 'meta-tags'
+gem 'active_link_to'
+
+say '   Configuring meta-tags...', :cyan
+initializer 'meta_tags.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  MetaTags.configure do |config|
+    # How many characters to truncate title to
+    config.title_limit = 70
+
+    # How many characters to truncate description to
+    config.description_limit = 160
+
+    # Truncate site_title if title is too long
+    config.truncate_site_title_first = false
+  end
+RUBY
+
+say '   Adding meta tags to layout...', :cyan
+inject_into_file 'app/views/layouts/application.html.erb', after: "<%= csp_meta_tag %>\n" do
+  "    <%= display_meta_tags site: '#{app_name.titleize}' %>\n"
+end
+
+say '   Creating SEO helper...', :cyan
+file 'app/helpers/seo_helper.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Usage in controllers or views:
+  #   set_meta_tags title: 'Page Title',
+  #                 description: 'Page description',
+  #                 keywords: 'keyword1, keyword2'
+  #
+  # Or use the helpers:
+  #   page_title 'My Page'
+  #   page_description 'Description here'
+  #
+  module SeoHelper
+    def page_title(title)
+      set_meta_tags title: title
+    end
+
+    def page_description(description)
+      set_meta_tags description: description
+    end
+
+    def page_image(image_url)
+      set_meta_tags og: { image: image_url },
+                    twitter: { image: image_url }
+    end
+
+    # Full SEO setup for a page
+    def page_seo(title:, description: nil, image: nil, type: 'website')
+      tags = {
+        title: title,
+        og: { title: title, type: type },
+        twitter: { card: 'summary_large_image', title: title }
+      }
+
+      if description
+        tags[:description] = description
+        tags[:og][:description] = description
+        tags[:twitter][:description] = description
+      end
+
+      if image
+        tags[:og][:image] = image
+        tags[:twitter][:image] = image
+      end
+
+      set_meta_tags tags
+    end
+  end
+RUBY
+
+say '   Creating navigation helper...', :cyan
+file 'app/helpers/navigation_helper.rb', <<~RUBY
+  # frozen_string_literal: true
+
+  # Navigation helpers using active_link_to
+  #
+  # Usage:
+  #   <%= nav_link_to 'Home', root_path %>
+  #   <%= nav_link_to 'Users', users_path, class: 'nav-item' %>
+  #
+  # The link gets an 'active' class when on that page.
+  # Customize with active_link_to options:
+  #   active: :exact         # Only exact URL match
+  #   active: :inclusive     # Match URL and sub-paths (default)
+  #   active: /regex/        # Match against regex
+  #   active: ['path1', 'path2']  # Match multiple paths
+  #
+  module NavigationHelper
+    def nav_link_to(name, path, options = {})
+      default_options = {
+        class: 'nav-link',
+        active_class: 'active'
+      }
+      active_link_to(name, path, default_options.merge(options))
+    end
+
+    # For nav items with icons
+    def nav_link_with_icon(name, icon_class, path, options = {})
+      content = tag.i(class: icon_class) + ' ' + name
+      nav_link_to(content, path, options)
+    end
+  end
+RUBY
+
+say 'SEO & navigation configured!', :green
+say '   Use `page_seo title: "..."` in controllers', :cyan
+say '   Use `nav_link_to` for auto-highlighting nav links', :cyan

modules/solid_queue.rb

···
-# frozen_string_literal: true
-
-say 'Setting up Solid Queue for background jobs...', :green
-
-gem 'solid_queue'
-gem 'mission_control-jobs'
-
-after_bundle do
-  say '   Running Solid Queue installer...', :cyan
-  rails_command 'generate solid_queue:install'
-
-  say '   Creating queue database...', :cyan
-  rails_command 'db:create:queue'
-
-  say '   Loading Solid Queue schema...', :cyan
-  rails_command 'db:schema:load:queue'
-end
-
-say '   Creating Solid Queue initializer...', :cyan
-file 'config/initializers/solid_queue.rb', <<~RUBY
-  # frozen_string_literal: true
-
-  # Solid Queue Configuration
-  # https://github.com/rails/solid_queue
-  #
-  # Database-backed Active Job backend that uses PostgreSQL for job storage.
-  # No need for Redis or external dependencies.
-
-  Rails.application.config.solid_queue.tap do |config|
-    # Silence polling queries in logs
-    config.silence_polling = true
-
-    # How often to check for new jobs (default: 0.1 seconds)
-    # config.polling_interval = 0.1
-
-    # Number of threads per worker (default: 3)
-    # config.workers_per_process = 3
-
-    # Concurrency per queue
-    # config.concurrency_maintenance_interval = 600
-  end
-RUBY
-
-say '   Configuring Active Job to use Solid Queue...', :cyan
-inject_into_file 'config/application.rb', after: "class Application < Rails::Application\n" do
-  "    config.active_job.queue_adapter = :solid_queue\n"
-end
-
-say '   Creating Procfile.dev entry...', :cyan
-append_to_file 'Procfile.dev', "jobs: bundle exec rake solid_queue:start\n"
-
-say 'Solid Queue configured!', :green
-say '   Dashboard at /admin/jobs (admin only)', :cyan
-say '   Jobs will be processed via: bin/jobs or rake solid_queue:start', :cyan
-say '   Run migrations: rails db:migrate', :yellow
-say '   Configure queues in config/solid_queue.yml', :cyan

template.rb

···
 end
 
 # ═══════════════════════════════════════════════════════════════════════════════
+# Remove Rails 8 defaults we'll replace
+# ═══════════════════════════════════════════════════════════════════════════════
+
+remove_file 'config/initializers/content_security_policy.rb'
+
+# ═══════════════════════════════════════════════════════════════════════════════
 # Base Setup
 # ═══════════════════════════════════════════════════════════════════════════════
 
···
 apply_module('credentials')
 apply_module('development_tools')
 apply_module('github')
+apply_module('logging')
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # Database & Infrastructure
···
 
 apply_module('database')
 apply_module('redis')
+apply_module('caching')
+
+# ═══════════════════════════════════════════════════════════════════════════════
+# Security
+# ═══════════════════════════════════════════════════════════════════════════════
+
+apply_module('security')
+apply_module('csp')
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # Authentication & Authorization
···
 apply_module('public_identifiable')
 apply_module('auth', ['run `rails db:migrate`'])
 apply_module('pundit')
-apply_module('security')
 
 # ═══════════════════════════════════════════════════════════════════════════════
-# Frontend
+# Frontend & SEO
 # ═══════════════════════════════════════════════════════════════════════════════
 
 gem 'tailwindcss-rails'
 apply_module('tailwind')
+apply_module('seo')
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # Background Jobs & Feature Flags
 # ═══════════════════════════════════════════════════════════════════════════════
 
-apply_module('solid_queue')
+apply_module('good_job')
 apply_module('flipper')
 
 # ═══════════════════════════════════════════════════════════════════════════════
···
 apply_module('blazer')
 apply_module('rails_performance')
 apply_module('console1984')
+apply_module('pghero')
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # Monitoring & Analytics
···
 apply_module('aasm')
 
 # ═══════════════════════════════════════════════════════════════════════════════
-# Pagination & Email
+# Email & Pagination
 # ═══════════════════════════════════════════════════════════════════════════════
 
 apply_module('kaminari')
 apply_module('mailkick')
+apply_module('email')
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # Admin Routes (must be last - depends on all admin modules)