What's Actually Running Behind Boardly

Most of what I write about on this blog is frontend: layout, Tailwind, responsive fixes. Boardly is different. Underneath the kanban board and the calendar view sits a real serverless backend, 14 Supabase Edge Functions, that quietly do things a static site never needs to. I wanted to write down what's actually running back there, partly because it's the part that never shows up in a screenshot.

An AI-written email that only sends when it should

Once a day, a scheduled function checks every account for tasks that are overdue or due today. If it finds any, it asks a free Groq-hosted model to write a short, plain-English summary of what needs attention, then emails it through Resend. The detail I care about most here isn't the AI part, it's that accounts with nothing due get skipped entirely. An empty "you have 0 tasks today" email is worse than no email at all, so the function checks first and only sends when there's something real to say.

SMS that actually gets through, in Nigeria

For critical alerts, Boardly uses Termii instead of the more famous Twilio. That wasn't a cost decision. Twilio has known reliability issues on Nigerian numbers, and Nigerian carriers enforce an 8PM to 8AM Do-Not-Disturb window on generic or promotional SMS routes. Termii's "DND" channel is specifically built to bypass that restriction for time-sensitive alerts. Picking the right provider for where your users actually are matters more than picking the popular one.

A Slack command that creates a real ticket

Type /addtask Call the printer tomorrow in Slack, and it becomes an actual Boardly ticket. The interesting part is the security, not the feature. This endpoint has to run with --no-verify-jwt, because Slack calls it directly with no Boardly login token attached. So identity here comes from two things instead: Slack's own cryptographic signature on the request, proving it genuinely came from Slack, and a lookup of which Boardly account has that Slack user's ID saved in Settings, proving which account the task belongs to. Skip the signature check and anyone who finds the URL could create tickets in someone else's workspace.

Calendar sync that fails quietly, on purpose

When a task with a due date is created, edited, or deleted, a function fires to keep Google Calendar in sync, creating, updating, or removing the matching event. It's deliberately fire-and-forget: if the sync fails (not connected, Google's down, a refresh token expired), the task itself has already saved successfully in Boardly. A calendar hiccup should never look like the actual ticket failed to save. That distinction, between the feature that's nice and the feature that's core, shapes how the whole function is written.

A service-role key, used carefully

Scheduled jobs like the daily digest need to read every account's tasks, not just one signed-in user's. That only works with Supabase's service-role key, auto-provided to Edge Functions, which bypasses Row Level Security entirely. It's the only way a background job can do its job, and it's also exactly why that key never touches the frontend. Everyday user access stays fully locked down by RLS; only these specific background functions get the elevated key, and only server-side.

None of this is visible in a demo video. But it's the difference between a kanban board that looks like a real product and one that actually behaves like one, quietly, in the background, whether anyone's watching or not.