Why I built it
Every new API project started with the same two days of setup: folder structure, error handling, validation, logging, auth, connection pooling. None of it was interesting, and teams redo it from scratch every time.
What it does
- Layered structure: routes, controllers, services, repositories, models
- JWT authentication with role-based access control
- Helmet security headers, rate limiting and CORS configuration
- Request IDs for tracing and structured JSON logging
- Health checks, graceful shutdown and database connection pooling
- OpenAPI 3.0 docs generated from the code, with Swagger UI
- Tests with Jest and Supertest; Docker Compose and a GitHub Actions pipeline
How it’s built
Starters usually fail one of two ways: too opinionated to adapt, or so bare that the real work is still yours. This one includes everything a real service needs in production and no business logic at all.
The hard part
The error model. A typed error hierarchy that flows through one handler means the API never leaks a stack trace as a 500 in production. Getting it to fit cleanly with the ORM and auth middleware took several iterations.
Stack
TypeScriptNode.jsExpressPostgreSQLSequelizeJWTDockerGitHub Actions