Outcomes
Product scope
NewFeed is a full social product rather than a static feed demo. Users can create accounts, publish posts and media, comment in realtime, and receive live notifications. The Next.js App Router frontend keeps authentication server-aware while Apollo Client, GraphQL subscriptions, and Socket.IO handle the interactive parts of the experience.
Service boundaries
The backend is split into an API gateway plus auth, post, comment, media, and notification services. The gateway is the public entry point: it validates the JWT cookie, applies rate limits and circuit breaking, then routes each request to the responsible service. PostgreSQL data stays inside service boundaries, while Cloudinary owns uploaded media.
- Auth uses REST and stores access tokens in httpOnly cookies.
- Posts and comments expose typed GraphQL APIs with cursor pagination.
- Comments stream through GraphQL subscriptions; notifications are pushed with Socket.IO.
- Redis supports caching, rate limiting, and Pub/Sub across replicas.
Event-driven workflows
RabbitMQ separates user-facing writes from follow-up work. Post and comment services publish domain events and return without waiting for notification delivery. Consumers fan those events out to connected users and cascade comment cleanup after a post is removed, so a slow notification worker does not block publishing.
Identity and trust boundaries
The browser never supplies a trusted user id. Identity comes from the signed access token in an httpOnly cookie, and internal calls carry a separate service token. Only Traefik exposes ports 80 and 443; individual services remain inside the cluster so bypassing the gateway does not become an alternate authentication path.
GitOps delivery
The platform runs on a single-node K3s cluster. GitHub Actions builds each service image in parallel, tags it with the commit SHA, and updates the separate configuration repository. ArgoCD detects that manifest change and reconciles the cluster, keeping CI credentials away from direct cluster access. Prometheus and Grafana provide node and cluster visibility.
Honest limits
The microservice split is intentionally more elaborate than the current traffic requires; the project exists to exercise independent failure modes, realtime scaling, and GitOps operations. It still runs on one VPS, application-level metrics are not yet exported, and secret rotation remains a manual deployment step. Those are the next operational gaps to close before treating the setup as multi-node production infrastructure.