When do you pick Node.js over Python?

Node.js fits APIs that sit next to a TypeScript frontend, webhook fans, and realtime sockets. Python fits data-heavy work, ML services, and teams already invested in that ecosystem. Mixed products often use both, with a clear owner for each service.

Do you use Express, Fastify, or Nest?

Fastify or Nest when the service will grow and needs structure. A smaller Express or framework-less Node server when the surface is a few routes. The choice follows team size and how strict the boundaries need to be.

Can Node.js be the BFF in front of other systems?

That is a common shape. The Node layer aggregates commerce, CRM, or internal APIs into the payloads the UI needs, and keeps secrets and retries off the browser.

How do you run Node.js in production?

As a container or a managed Node runtime, with health checks, structured logs, and a process manager or orchestrator. We do not treat `node server.js` on a single VM as the long-term plan unless that is an explicit constraint.

Do you support GraphQL?

When the UI needs flexible selection and you already operate GraphQL, we deliver it. For many products we start with versioned REST and OpenAPI, then add GraphQL only where it earns the complexity.

How do you handle background jobs?

Queues (Redis, SQS, or RabbitMQ) for email, PDFs, and sync. Request handlers stay short; workers own retries and dead-letter paths.

What observability do you ship with Node APIs?

Structured JSON logs with request IDs, health and readiness probes, error tracking, and latency dashboards for critical routes. Alerts route to the people on call.

How do you version APIs?

URL or header versioning with deprecation windows. Breaking changes are negotiated with consumers and reflected in OpenAPI before release.

zupitrix — node@services

$ cat README.md

Node.js

# Node.js in production.

Zupitrix builds Node.js services when the web app needs an API, a backend-for-frontend, or a realtime channel. Contracts are typed, errors are structured, and the process is something your team can log, scale, and redeploy.

$ npm run start:project

Start Project ./modules ↓

CONTRACT01

Typed request & response

EDGE02

Auth before handlers

OPS03

Health, logs, metrics

JOBS04

Queue-backed work

SCALE05

Stateless processes

./practice

modules.exports

HTTP APIs, BFF layers, and realtime services with contracts, logs, and a deploy story.

01

A contract before handlers

Request and response shapes are shared with the frontend. Breaking changes get a version or a migration, not a silent field rename. We document the approach, name owners, and attach acceptance checks so “A contract before handlers” is reviewable in demos and durable after handoff.

02

Auth at the boundary

Sessions, JWTs, or service tokens are checked before business logic. Webhooks verify signatures. We document the approach, name owners, and attach acceptance checks so “Auth at the boundary” is reviewable in demos and durable after handoff.

03

Failure you can see

Timeouts, retries, and idempotency keys are explicit. Logs include a request id the UI can quote. We document the approach, name owners, and attach acceptance checks so “Failure you can see” is reviewable in demos and durable after handoff.

04

A runtime with limits

Memory, concurrency, and connection pools are sized. Background work is a queue when it should not block the request. We document the approach, name owners, and attach acceptance checks so “A runtime with limits” is reviewable in demos and durable after handoff.

./build

routes we ship

POST
Product APIs
CRUD and workflow endpoints for web and mobile clients, with pagination and consistent errors. We document the approach, name owners, and attach acceptance checks so “Product APIs” is reviewable in demos and durable after handoff.
POST
Backend-for-frontend
One Node service that shapes data for a specific UI and hides upstream complexity. We document the approach, name owners, and attach acceptance checks so “Backend-for-frontend” is reviewable in demos and durable after handoff.
POST
Realtime channels
Socket or SSE updates for collaboration, orders, or device status, backed by the same auth model. We document the approach, name owners, and attach acceptance checks so “Realtime channels” is reviewable in demos and durable after handoff.

./pipeline

release log

01
Boundary
Decide what this service owns and what it only calls. Exit criteria and owners are written down before the next step starts.
02
Contract
Publish types or an OpenAPI spec the clients generate from. Exit criteria and owners are written down before the next step starts.
03
Harden
Auth, validation, rate limits, and idempotent writes. Exit criteria and owners are written down before the next step starts.
04
Operate
Health checks, logs, and a rollback path. Exit criteria and owners are written down before the next step starts.
05
Harden
Validate budgets, failure modes, observability, and rollback before traffic. Exit criteria and owners are written down before the next step starts.
06
Handoff
Runbooks, access, and training so the client team can operate without us. Exit criteria and owners are written down before the next step starts.

package.json

dependencies

Node.js
TypeScript
Fastify
Express
NestJS
PostgreSQL
Redis
Docker
OpenAPI
Jest
RabbitMQ

services

where Node shows up

Custom Website Development
Sites and apps that need a Node API beside the UI.
Payment Integration
Webhook and checkout services that often run on Node.
CI/CD Pipelines
Build and release for the service, not only the frontend.

Outcomes

What we optimize for

Product and engineering goals we keep visible from the first slice through handoff — so velocity never quietly trades away quality.

p95Latency budgets per route

IdempotentWebhook writes

OpenAPIClient-ready contracts

12-factorConfig via env

HealthLive + ready probes

DLQFailed job path

At a glance

Delivery facts

Typical timelines, coverage, and operating constraints we set expectations against before the build surface expands.

Topic	Value	Note
API skeleton	1–2 weeks	Auth + health + CI. Tracked against Node.js delivery milestones.
Framework	Fastify/Nest	Fit to team & domain. Tracked against Node.js delivery milestones.
Default DB	PostgreSQL	Unless constrained. Tracked against Node.js delivery milestones.
Jobs	Queue-backed	Never block HTTP. Tracked against Node.js delivery milestones.
Contracts	OpenAPI	Or shared TS packages. Tracked against Node.js delivery milestones.
Deploy	Container	ECS/K8s/Node host. Tracked against Node.js delivery milestones.

Ecosystem

Technologies that sit beside it

Real stack partners we wire into delivery with clear roles — not decorative logos on a slide.

Node.js

Server runtime for APIs, jobs, and SSR hosts.

TypeScript

Service code — integrated deliberately into delivery with TypeScript.

Fastify

HTTP framework — integrated deliberately into delivery with Fastify.

Express

Legacy APIs — integrated deliberately into delivery with Express.

NestJS

Structured apps — integrated deliberately into delivery with NestJS.

PostgreSQL

Transactional source of truth with backup and access control.

Redis

Queues & cache — integrated deliberately into delivery with Redis.

RabbitMQ

Messaging — integrated deliberately into delivery with RabbitMQ.

Docker

Containers — integrated deliberately into delivery with Docker.

Prisma

ORM — integrated deliberately into delivery with Prisma.

OpenAPI

Contracts — integrated deliberately into delivery with OpenAPI.

Jest

Tests — integrated deliberately into delivery with Jest.

Integrations

Systems we commonly connect

CMS, identity, commerce, analytics, and edge services joined with typed contracts, webhooks, and ownership — not ad-hoc glue.

Stripe

Payments webhooks — integrated deliberately into delivery with Stripe.

AWS

Compute & queues — integrated deliberately into delivery with AWS.

PostgreSQL

OLTP — integrated deliberately into delivery with PostgreSQL.

Redis

Cache / jobs — integrated deliberately into delivery with Redis.

Auth0

JWT validation — integrated deliberately into delivery with Auth0.

SendGrid

Email — integrated deliberately into delivery with SendGrid.

Architecture

Layers we design explicitly

Boundaries, ops knobs, and rollback policy for each layer — so one team can change without rewriting everything.

HTTP edge

Framework, auth, validation, rate limits.

Fastify/Nest
JWT
Zod

Domain services

Use-cases without framework details.

Commands
Queries
Policies

Persistence

Repositories, transactions, migrations.

Postgres
Prisma
SQL

Async boundary

Queues and workers for slow work.

Redis
SQS
Retries

Ops plane

Health, metrics, tracing, alerts.

Probes
Sentry
Dashboards

Capabilities

What we actually deliver

Concrete workstreams with owners, acceptance checks, and a path for your engineers to extend after handoff.

Typed API contracts

OpenAPI or shared packages so clients generate against truth.

Auth at the edge

Sessions, JWTs, and service tokens checked before business logic.

Queue-backed work

Background jobs for email, PDF, and sync so requests stay fast.

Observability

Structured logs, request IDs, and health probes for operators.

Data access layers

Repositories over raw SQL or ORM with transactions where they matter.

Horizontal-ready process

Stateless handlers, connection pools, and graceful shutdown.

Rate limits & abuse controls

Per-route and per-tenant throttles with clear 429 semantics.

Migration-safe deploys

Expand/contract with the database team’s cadence.

Idempotent writes

Keys and dedupe tables for webhooks and retries.

Patterns

Approaches we reach for

Reference implementations and conventions in the repo — so reviews reject one-off variants that bypass the agreed shape.

Hexagonal-ish services

Keep HTTP adapters thin around domain logic.

Reference implementation of “Hexagonal-ish services” lives in the repo, not only slides.

Outbox / reliable events

When downstream systems must not miss writes.

Reference implementation of “Outbox / reliable events” lives in the repo, not only slides.

BFF aggregation

Shape payloads for one UI without leaking internals.

Reference implementation of “BFF aggregation” lives in the repo, not only slides.

Idempotency keys

Client and webhook retries stay safe.

Reference implementation of “Idempotency keys” lives in the repo, not only slides.

Circuit breakers

Protect the process from flaky upstreams.

Reference implementation of “Circuit breakers” lives in the repo, not only slides.

Feature flags server-side

Rollouts without redeploying clients.

Reference implementation of “Feature flags server-side” lives in the repo, not only slides.

Industries

Domains we apply this in

Same technical playbook, different module depth — regulation, uptime, and partner APIs baked in early.