What the generated Rails app contains
Application structure (API mode + Devise)
app/
controllers/
api/
v1/
auth_controller.rb # Devise-based token auth
{entities}_controller.rb # resourceful controller per entity
application_controller.rb # before_action :authenticate_user!
models/
user.rb # Devise modules, workspace association
workspace.rb
{entity}.rb # ActiveRecord model + validations + scopes
policies/
{entity}_policy.rb # Pundit authorization per entity
serializers/
{entity}_serializer.rb # jsonapi-serializer (no accidental field leaks)
services/
{entity}_service.rb # business logic, transaction blocks
jobs/
{entity}_job.rb # Sidekiq workers (when async ops in genome)
mailers/
user_mailer.rb # welcome, password reset, notifications
db/
migrate/
TIMESTAMP_create_{entities}.rb # one migration per entity
seeds.rb
config/
routes.rb # namespace :api, defaults: {format: :json}
initializers/
cors.rb
devise.rb
spec/ # RSpec
models/
{entity}_spec.rb
requests/
api/v1/{entities}_spec.rb # request specs (preferred over controller specs)
factories/
{entity}.rb # FactoryBot factories
support/
devise.rb
database_cleaner.rb
frontend/ # Next.js app
app/
(auth)/
login/page.tsx
(protected)/
{entity}/page.tsx
Gemfile
Dockerfile
docker-compose.yml
Makefile
Database layer
- ActiveRecord ORM — no raw SQL queries
- One migration per entity —
add_indexon all foreign key columns - Multi-tenant scoping:
default_scopeor explicit.where(workspace_id: current_workspace.id)on every query - Soft deletes via
paranoiagem where data retention matters - PostgreSQL — never SQLite (the default
rails newuses SQLite; this generator overrides it)
Auth and security
- Devise with JWT (
devise-jwtgem) — tokens issued as httpOnly cookies - Pundit policies for every entity —
authorize @entitybefore every write strong_parameterson every controller action — nopermit!- Secrets from
ENV['KEY_NAME']via dotenv — nothing hardcoded - Rate limiting on Devise auth endpoints via
rack-attack
API design
- Resourceful controllers:
index,create,show,update,destroy - Routes match the generated OpenAPI 3.1 spec
{Entity}Serializeron every response — never expose AR model attributes directly- Consistent error format:
{"error": "snake_case_code", "message": "Human readable description."} - 201 for creation, 422 for validation errors, 403 for auth/permission, 404 for not found
- Pagination via
kaminariorpagy
Tests (RSpec)
- Request specs for every API endpoint
- Model specs for validations, associations, and scopes
- Policy specs for every Pundit policy
- FactoryBot factories for every model — no hard-coded fixture data
DatabaseCleanertransaction rollback between testsshoulda-matchersfor concise model validation assertions
Infrastructure
- Multi-stage Dockerfile (ruby:3.3-alpine — compiled gems in build, copy to production)
docker-compose.yml: Rails app + PostgreSQL + Redis (Sidekiq queues)Makefile:make dev,make test,make migrate,make console- GitHub Actions:
rubocop→rspec→docker build→ deploy
Rails vs Sinatra vs Hanami
Choose Rails when:
- You want convention over configuration — Rails decisions are made for you, freeing you to focus on your product
- You need the full Rails stack: ActiveRecord, Action Mailer, Active Job, Action Cable
- Hiring Ruby developers from a large talent pool
- You're building a product where velocity matters more than micro-optimization
Rails is the reason the Ruby ecosystem exists. For API-first SaaS products in Ruby, it remains the correct default.
vs rails/railsbytes and other Rails starters
rails new gives you a skeleton. railsbytes.com gives you snippets. jumpstartpro gives you auth and billing UI.
What none of them give you: your models, your controllers, your business logic, your migrations, your tests — the 80% that is specific to your product.
Archiet generates the complete Rails application for your specific product.
CTA
Generate a complete Ruby on Rails + Next.js application from your requirements — free plan, no credit card.
Describe your product, pick Rails, download a production-ready codebase in 90 seconds.
Start free at archiet.com.