Scalable
Backend Core.

// server/index.ts
import express from "express";
import helmet from "helmet";
import cors from "cors";
import rateLimit from "express-rate-limit";
import pino from "pino-http";

const app = express();
const PORT = Number(process.env.PORT) || 3000;

// Security: HTTP-Headers, XSS-Protection, HSTS
app.use(helmet());

// CORS: nur erlaubte Origins
app.use(cors({
  origin: process.env.ALLOWED_ORIGINS?.split(","),
  credentials: true,
}));

// Rate-Limit: 100 Requests / 15 Minuten / IP
app.use(rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: true,
}));

// Structured Logging fuer Observability
app.use(pino({ level: process.env.LOG_LEVEL ?? "info" }));

// JSON-Body-Parser mit Limit gegen DoS
app.use(express.json({ limit: "1mb" }));

// Health-Check fuer Load Balancer / Railway
app.get("/healthz", (_req, res) => {
  res.json({ status: "ok", uptime: process.uptime() });
});

// Domain Routes
app.use("/api/v1", require("./routes/v1").default);

// Server starten
const server = app.listen(PORT, () => {
  console.log(`API listening on :${PORT}`);
});

// Graceful Shutdown — keine verlorenen Requests bei Deploys
process.on("SIGTERM", () => {
  server.close(() => process.exit(0));
});

// server/middleware/cache.ts
import { createClient, RedisClientType } from "redis";
import type { Request, Response, NextFunction } from "express";

const redis: RedisClientType = createClient({
  url: process.env.REDIS_URL,
});
await redis.connect();

export function cache(ttlSeconds = 60) {
  return async (
    req: Request,
    res: Response,
    next: NextFunction,
  ) => {
    // Nur GET-Requests cachen
    if (req.method !== "GET") return next();

    const key = `cache:${req.originalUrl}`;
    const hit = await redis.get(key);

    if (hit) {
      res.setHeader("X-Cache", "HIT");
      return res.json(JSON.parse(hit));
    }

    // Original res.json patchen, um Antwort zu cachen
    const original = res.json.bind(res);
    res.json = (body: unknown) => {
      redis.setEx(key, ttlSeconds, JSON.stringify(body));
      res.setHeader("X-Cache", "MISS");
      return original(body);
    };

    next();
  };
}

// Verwendung in Route:
// router.get("/products", cache(300), listProducts);

# docker-compose.yml
version: "3.9"

services:
  api:
    build: ./server
    deploy:
      replicas: 3              # 3 Node.js-Instanzen
    environment:
      MONGODB_URI: mongodb://mongo:27017/app
      REDIS_URL: redis://redis:6379
      NODE_ENV: production
    depends_on:
      - mongo
      - redis

  mongo:
    image: mongo:7
    command: ["--replSet", "rs0", "--bind_ip_all"]
    volumes:
      - mongo-data:/data/db
    ports:
      - "27017:27017"

  redis:
    image: redis:7-alpine
    command: redis-server --maxmemory 256mb
    volumes:
      - redis-data:/data

  nginx:
    image: nginx:1.25-alpine
    ports:
      - "80:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - api                    # Round-Robin zu API-Replikas

volumes:
  mongo-data:
  redis-data: