Three services and nothing to store
Originally published at eyosias.me . This is a chapter in the Ivyk8 series. Last time: I cut a flagship-platform plan down to three stateless TypeScript services and five written decisions. This chapter is the result: what runs, how a request travels, and what keeps it safe. TL;DR The app reads an Android money manager’s backup from the user’s Google Drive and turns it into reports. Three…
The application consists of three stateless TypeScript services: a static React dashboard, a public backend called drive-sync-service, and an internal calculator called analytics-service. A report request is determined solely by the backup file, timezone, and any rate overrides provided. Changing the timezone results in the same request running again with new parameters. No data is stored in this system.
The user experience starts with a browser connecting to the ingress (Traefik) which routes the request to either the web-dashboard React app served by nginx or the drive-sync-service API. The dashboard is completely static and serves all user interface needs, while the drive-sync-service handles Google sign-in, Drive read-only access, token refresh, and manages encrypted session cookies.
The analytics-service is only reachable within the cluster and is responsible for validation, business rules, exchange rate handling, and producing the final report numbers.
The entire process of opening a report happens via a single request from the browser to the drive-sync-service, which decrypts the session cookie, refreshes the Google access token if needed, and validates the requested file is within the user's choosen folder. The service then requests the report from analytics-service, which fetches the necessary backup data, performs the calculations, and returns the results along with relevant rates and any warnings.
If the data is missing or an error occurs, the request will return a 404 status code, prompting the user to reconnect.
Security in this system is largely achieved through subtraction – by removing certain capabilities. Tokens are never exposed to the browser, the analytics-service is only accessible from within the cluster, and every container runs with restricted privileges. The system uses a deny-all approach to network policies, only allowing traffic to specific endpoints as required. Pod security is restricted to prevent root access or privilege escalation, and the container images are kept small to minimize attack surface.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
