
What I learned applying production patterns to a NestJS modular monolith (side project, ~1 year)
I've been building an open-source e-commerce API since last July. 9 DDD modules, Hexagonal Architecture, SAGA checkout, BullMQ, PostgreSQL, Redis. It's a side project and hasn't been deployed, but I've been applying real production patterns to learn how they actually work, not just read about them.
Last time I posted was at v0.2.0. Since then, I've gone through auth, security, Docker, and observability. Here's what was harder than expected.
For Auth, I migrated from nestjs/passport to raw RSA RS256 with jose. Private key signs, public key verifies, JWKS endpoint for external verification. Then, I added refresh token rotation and ripped out the role enum to build a normalized Role/Permission system backed by the database. The RBAC guard checks the JWT payload; no module imports Auth directly.
And then it comes to Observability, First time doing this.
Winston structured logs → Loki, prom-client → Prometheus, OpenTelemetry → Tempo, all wired to Grafana.
The correlation ID system uses AsyncLocalStorage and propagates through BullMQ by embedding the ID in job payloads and restoring context in workers.
I also implemented Helmet, CORS whitelisting, XSS sanitization interceptor, 4-stage Docker build with tini, graceful shutdown handling for BullMQ workers and WebSocket connections, API versioning, and Redis-backed rate limiting.
Repo: https://github.com/raouf-b-dev/ecommerce-store-api
Would appreciate any technical feedback, especially on the ACL gateway pattern I'm using for cross-module communication and the observability setup.