# Policy for Choosing Languages and Frameworks

## General

Languages are allowed only if they meet **all** of the following criteria:

1. **Null safety**
   - C++ is not allowed; use Rust instead.
   - Java is not allowed; use Kotlin instead.
2. **Type safety**
   - For Python, type hints with a strict type checker are mandatory.
   - Use TypeScript instead of JavaScript.
   - Only `.ts` files are allowed, even for configs.
3. **Concurrency support**
   - Event-driven, async models only.
   - Thread-based models are not allowed.

Never mix backend and frontend **runtime code**. Doing so can lead to serious security vulnerabilities.

Choose technologies that align with the business idea and available resources to enable rapid validation.

Using linters, formatters, and CI is strongly recommended.

Put CI workflows in top-level `.gitea` directory and use the `self-hosted` machine.

## Containers

Use Podman instead of Docker. Podman is commercially free and vendor-neutral. Use `Containerfile`, `compose.yaml`, and `.containerignore` filenames instead of `Dockerfile`, `docker-compose.yml`, and `.dockerignore`.

## Backend

Containerization is mandatory for all backend services.

For Python, always use `uv`, `ruff`, and `ty` for code quality.

## Frontend

A **no-framework approach is mandatory**. Always focus on web standards. Web components composed of pure HTML, CSS, and TypeScript must be used. Third-party frameworks do not guarantee long-term security, stability, or continued adoption.

By using only web components, we achieve:

- A central UI component library with design consistency
- Improved security
- Better end-user performance
- Long-term maintainability
- Direct DOM debugging capabilities

This means banned options include, but are not limited to:

- React
- Tailwind
- Vue
- Svelte
- Angular
- Solid

Currently approved options are:

- [Lit](https://lit.dev)
- [Web Awesome](https://webawesome.com)

For new and migrated TypeScript projects, use [Node.js](https://nodejs.org) (24 LTS) with [Vite+](https://viteplus.dev) (`vp`). Vite+ provides linting (Oxlint), formatting (Oxfmt), type checking, testing (Vitest), and bundling (tsdown).

The only config files in each TypeScript project are `package.json`, `tsconfig.json`, and `vite.config.ts`.