Architecture

Two independently deployable services sharing one repo. Neither calls the other — perf-api has zero dependencies by design, secure-api owns its own Postgres and Redis. Diagrams below match the actual code, not an aspirational design doc.

System overview

Both services expose Actuator + Prometheus metrics; Grafana (local only) visualizes them. Nothing here is deployed to Railway except the two API services.

perf-api — request lifecycle

Every request stays on the Netty event loop. No thread pool, no blocking hop, no auth check.

secure-api — register & login

Passwords never leave the service in any form; refresh tokens are stored as a hash, never as the plaintext value handed to the client.

secure-api — refresh rotation & reuse detection

Every refresh is single-use. Presenting an already-used token is treated as a stolen-token replay: every session for that user is revoked, not just the one request.

secure-api — rate-limit decision

The tier (20/min anonymous vs 100/min authenticated) falls out naturally from whether a valid JWT was presented — no path-based special-casing in the rate limiter itself.