Architecture
How I structure systems so they survive growth, stay safe to change, and remain secure.
Architectural styles
Modular monolith
One deployable with firm internal boundaries: most of the benefit, almost none of the distributed cost.
Used in projectsMicroservices
Splitting the system into small, independently deployable services with their own lifecycle.
Used in projectsEvent-driven
Components talk through events instead of direct calls, which loosens the coupling.
Used in projectsServerless
Hand the server to the provider: you deploy code and pay for actual usage.
Used in projectsHexagonal architecture
Ports and adapters: the domain defines interfaces and infrastructure plugs in from outside.
LearningBFF
Backend for Frontend: one layer per client type, giving it exactly what it needs.
LearningSoftware design
SOLID
Five object-oriented design principles that keep code able to absorb change.
Used in projectsClean Architecture
Layers where dependencies point inwards and the domain knows nothing about infrastructure.
Used in projectsDDD
Domain-Driven Design: model the software in the language and rules of the business.
Used in projectsCQRS
Separate the write model from the read model, so each can be optimised on its own.
Used in projectsDependency injection
Receive dependencies from outside instead of constructing them — the basis of isolated testing.
Used in projectsRepository and Unit of Work
Abstract data access and group changes into a single coherent transaction.
Used in projectsEvent Sourcing
Store the sequence of events instead of the final state, and rebuild it when needed.
LearningIntegration patterns
API Gateway
A single front door that routes, authenticates and throttles traffic to the services.
Used in projectsCircuit Breaker
Stop calling a failing service, so it does not drag the whole system down with it.
Used in projectsRetry with backoff
Space out retries and add jitter, so you do not cause a stampede of your own.
Used in projectsIdempotency
Repeating an operation changes nothing. Essential the moment retries are involved.
Used in projectsSaga
Transactions spread across services, with compensating steps instead of a rollback.
LearningOutbox
Write the event in the same transaction as the data, so no message is ever lost.
LearningAPIs and contracts
Web APIs
Designing HTTP interfaces: resources, verbs, status codes, versioning and contracts.
Used in projectsREST
API style built on resources, HTTP verbs and stateless responses.
Used in projectsAPI versioning
Evolving an API without breaking its consumers, and knowing when a new version is due.
Used in projectsWebhooks
Outbound HTTP notifications: instead of asking, the service tells you.
LearningData and scalability
Distributed cache
Keep expensive results where every instance can see them, and know when to invalidate.
Used in projectsHorizontal scaling
Grow by adding instances rather than a bigger machine, which forces you to go stateless.
Used in projectsRead replicas
Offload queries to copies of the database, accepting a small lag in the data.
Used in projectsRate limiting
Cap how many requests the system accepts, to protect it from abuse and spikes.
Used in projectsEventual consistency
Let copies converge over time in exchange for availability and speed.
LearningCAP theorem
Under a network partition you must choose between consistency and availability.
LearningSharding
Split the data across several databases by a key, once it no longer fits in one.
LearningSecurity
OAuth 2.0
The standard for delegating authorisation without sharing credentials between systems.
Used in projectsOpenID Connect
An authentication layer on top of OAuth 2.0: beyond permissions, it says who the user is.
Used in projectsJWT
Signed tokens carrying identity and claims, so the server is not queried on every request.
Used in projectsSecret management
Get keys and passwords out of the code and the repository, and rotate them without a deploy.
Used in projectsTLS / HTTPS
Encryption in transit and server identity validation through certificates.
Used in projectsOWASP Top 10
The reference list of the most common security risks in web applications.
Learning