In progress
Fira
Backend architecture|Self-hosted identity, streaming, and orchestration
TLDR
Backend architecture for a self-hosted platform. Keycloak for identity, Kafka for event streaming, Redis for cache and coordination, Docker for packaging, and .NET Aspire for local orchestration. Frontend is out of scope for this write-up.
Context. Build a backend foundation that can run fully self-hosted: strong identity, reliable event flow, fast cache, and a developer experience that stays coherent across services.
KeycloakKafkaRedis
Docker.NET AspireASP.NET CoreAnalyticsFeature flags
Docker.NET AspireASP.NET CoreAnalyticsFeature flagsComponent map
As deployed
Identity
Keycloak
IDP, realms, clients
Application
Domain APIs
ASP.NET Core
Consumers
Kafka workers
Platform
Kafka
Event streaming
Redis
Cache and coordination
Docker
Self-hosted packaging
.NET Aspire
Local orchestration
What shipped
- Backend architecture only. Product UI is not part of this stage.
- Keycloak as the identity provider for authn and authz across services
- Kafka as the backbone for async domain events and integration
- Redis for cache, short-lived coordination, and rate or session adjacent needs
- Dockerised services for repeatable local and server deployment
- .NET Aspire for composing and running the local distributed stack
- Analytics and feature flags planned into the platform from day one
Backend
- Service boundaries oriented around identity, domain APIs, and event consumers
- Keycloak realms and clients as the source of truth for identity and tokens
- Kafka topics for domain events with consumer groups per worker responsibility
- Redis for hot reads and coordination where strong consistency is not required
- Aspire AppHost wiring for local dependency graphs, ports, and health
Request and event flow
- 01Client authenticates against Keycloak and receives tokens
- 02API validates tokens and accepts domain commands
- 03Commands that need fan-out publish events to Kafka
- 04Workers consume topics, update state, and write side effects
- 05Redis absorbs hot lookups and short-lived locks where useful
- 06Feature flags gate incomplete or risky paths while the platform evolves
API domains
- Identity and token exchange
- Domain APIs
- Event producers
- Event consumers
- Admin and ops hooks
- Feature flags
- Analytics ingestion
Key decisions
- Keep the current write-up backend-only so identity, streaming, and orchestration stay clear before UI work begins.
- Use Keycloak as a self-hosted IDP instead of a SaaS auth vendor, to keep identity under local control.
- Use Kafka for durable event flow between APIs and workers rather than ad hoc HTTP fan-out.
- Use Redis for cache and coordination, not as the system of record.
- Compose the stack with Docker and .NET Aspire so local runs match the intended self-hosted topology.
- Include analytics and feature flags in the platform contract early, even while the product is in progress.