01 · Architecture
Decisions before code
Clean architecture with the dependency direction enforced by ArchUnit, a version matrix checked against release pages, eleven ADRs, a definition of done.
Read now
← Janaka Academy · Learning series
From code to production: building AssetCare.
Fourteen modules that follow one real application from its first architecture decision to a public URL on Kubernetes. The application is AssetCare, live today on Java 25, Spring Boot 4.1, Angular 22, PostgreSQL, Keycloak, K3s and Helm; the full source is available to learners on request, so every module ends with something you can run. This is a case study and engineering walkthrough, published progressively: what is written today is linked, what is still to come is labelled as such.
Case study · engineering walkthrough
Java 25 · Spring Boot 4.1 · Angular 22
Kubernetes · Helm · Terraform
Live reference deployment
Coming progressively
How to use this series
Read a module, then run the thing it describes.
Who it is for
Engineers who can write a Spring or Angular application and want to see, on a real codebase, everything that surrounds it in production: identity, migrations, containers, a cluster, TLS, a pipeline, backups and operations.
What you need
Java 25, Node 24, Docker. make doctor in the source repository (access on request) checks all three. The setup guide starts from an empty machine and verifies every step. A cloud account is needed only from module 09 onwards.
Where the material lives today
The seven-course walkthrough already covers most modules with why, what, how and proof. The case study covers the live deployment and its verification. Dedicated lessons with exercises are added module by module.
Modules
Fourteen steps from architecture to operations.
Each card says where the material is now. "Read now" links to the existing walkthrough or case study section; "lesson coming" means a dedicated lesson with exercises has not been produced yet.
02 · Spring Boot backend
The API on Java 25 and Spring Boot 4.1
Use cases and ports, Problem Details errors, optimistic locking with If-Match, idempotency keys, an audit event for every write, authorization as a policy.
Read now
03 · Angular frontend
The Angular 22 application
URL-held list state, conflict detection, drafts, attachments, a command menu, design tokens, dark mode, phone layout, accessibility rules, a strict CSP in the production build.
Read now
04 · PostgreSQL and Liquibase
Schema as changesets, validated by Hibernate
The database model with every column, constraint and index; changesets with rollbacks; dev and prod contexts; Testcontainers to prove the changelog and the entities agree.
Read now
05 · Authentication with Keycloak
OpenID Connect with PKCE and a resource server
Realm, clients and roles; the SPA's authorization-code flow; JWT validation in the API; USER, ADMIN and AUDITOR; what the UI hides and what the API refuses regardless.
Read nowLesson coming
06 · Docker
Multi-arch, non-root images
A JRE image with a container-aware heap and graceful shutdown; unprivileged nginx rendering its runtime config; Compose for the stateful parts; Trivy and SBOM on every build.
Read nowLesson coming
07 · Kubernetes and K3s
One node, every object in its place
Why K3s, what the installer does, probes that drive restarts and traffic, what the ingress exposes and what stays inside, and the interactive board that assembles the cluster step by step.
Read nowLesson coming
08 · Helm
The chart as the deployment unit
Every environment difference as a value; enterprise switches for an external database, identity provider, object storage and vault secrets; lint and template in CI; rollback.
Read nowLesson coming
09 · Infrastructure with Terraform
A server, a firewall and backups as code
Hetzner Cloud with the hcloud provider: the CX33, a cloud firewall, a cloud-init user, nightly server backups; why the free tier was abandoned and what that decision cost.
Read nowLesson coming
10 · HTTPS with cert-manager
Certificates without a human
ClusterIssuers for staging and production, HTTP-01 through Traefik, DNS, the moment the certificate goes Ready, and automatic renewal.
Read nowLesson coming
11 · CI/CD
Three workflows: ci, security, release
Tests at every level, Playwright against the production image, a restore drill, Helm and Terraform validation, image scans, CodeQL, gitleaks, signed multi-arch releases with SBOM and provenance.
Read now
12 · Observability
Logs, metrics and traces that share an id
Structured logs with request and trace ids, Micrometer, OpenTelemetry, and the optional profile with Prometheus, Grafana, Loki and Tempo that runs locally and is not yet deployed on the small production server.
Read now
13 · Production health checks
Probes, smoke test, health script, runbook
Liveness and readiness groups, what was verified from outside the server and how, the one-command health summary, backups with a rehearsed restore, and the "the VM is gone" procedure.
Read nowLesson coming
14 · AI-assisted engineering workflow
Speed inside written rules
A CLAUDE.md with the non-negotiables, project skills for the common changes, what the assistant accelerated, what stayed with the engineer, and how the verification report keeps both honest.
Read nowLesson coming
Or look at the finished thing first
The live deployment has a public demo account with fictional sample data. Sign in, change something, upload a file, read the audit trail, then come back and find the code that did it.