Movie Mate is a full-stack, polyglot platform that delivers personalised movie recommendations with Dapr sidecars, Kafka, and end-to-end observability. Deployed on Kubernetes (k3s or full k8s). Security first via JWT at the edge.
- 🏗️ System Overview
- 📚 Tech Stack
- 🧠 Microservices
- 🛠️ Platform & Utilities
- 🔒 JWT Auth Flow
- 🌐 Observability
- 🗺️ Roadmap
| Layer | Tech |
|---|---|
| Frontend | React, TypeScript, Next.js, Tailwind |
| API Gateway | Traefik + Consul (service discovery) |
| Microservices | Java • Node.js • Kotlin • Python |
| Communication | Dapr Sidecars • Kafka Pub/Sub • REST |
| Databases | PostgreSQL • MongoDB • Redis • Neo4j |
| Observability | Prometheus • Loki • Jaeger • OpenTelemetry • Grafana |
| CI/CD | GitHub Actions • Docker |
| Platform | Kubernetes (k3s) |
| Security (app) | JWT (validated by User Service via API Gateway) |
| Security (internal) | Keycloak |
| Docs | OpenAPI (aggregated in mm-openapi-hub) |
| Service | Purpose | Tech |
|---|---|---|
mm-user-service |
Users & authentication |   |
mm-movie-service |
Movies, genres, metadata |  |
mm-recommendation-service |
Recommendation engine (consumes activity & catalog events) |  |
mm-activity-service |
Tracks user actions across services |  |
mm-api-gateway |
Single entrypoint; routing & rate limits |  |
mm-discovery-server |
Service registration & discovery (Consul) |  |
| Repo | Description | Tech |
|---|---|---|
mm-app-view |
Frontend |   |
mm-infrastructure |
IaC, manifests, CI/CD pipeline for deployment |   |
mm-openapi-hub |
Centralised Swagger UI for all services |  |
One way in: the API Gateway is the bouncer; User Service is the ID checker.
sequenceDiagram
autonumber
participant C as Client
participant G as Traefik (API Gateway)
participant U as mm-user-service
participant S as Target Service
C->>G: HTTP request + Authorization: Bearer <JWT>
G->>U: Introspect/validate JWT
U-->>G: 200 OK (claims) / 401 Unauthorized
alt token valid
G->>S: Forward original request (with verified identity)
S-->>G: Response
G-->>C: Response
else invalid
G-->>C: 401 Unauthorized
end
This deployment secures internal services (e.g., Grafana, TraefikApi) using OAuth2 Proxy with Keycloak as the identity provider. It ensures that only authenticated users with valid sessions can access sensitive dashboards.
sequenceDiagram
autonumber
participant C as Client
participant T as Traefik (API Gateway)
participant O as oauth2-proxy
participant K as Keycloak (OIDC)
participant S as Internal Service
C->>T: Request to /mmate/internal/service
T->>O: Forward request to oauth2-proxy
alt No valid session cookie
O-->>C: 302 Redirect to Keycloak
C->>K: Login (OIDC)
K-->>C: Redirect with auth code
C->>O: /oauth2/callback + code
O->>K: Exchange code for tokens
K-->>O: ID/Access token
O-->>C: Set session cookie + redirect
C->>T: Retry original request
T->>O: Forward to oauth2-proxy
end
alt Valid session
O->>S: Forward request with identity headers
S-->>O: Response
O-->>T: Response
T-->>C: Response
else Unauthorized
O-->>C: 401 / Redirect to login
end
Everything is observable out of the box. Metrics, traces, and logs in real time using:
- 📈 Prometheus: Metrics collection
- 🧠 Grafana: Unified dashboards
- 🔍 Loki: Log aggregation
- 🛰️ Zipkin: Distributed tracing
- 📡 OpenTelemetry Collector: Unified observability pipeline
Planned and upcoming features for Movie Mate — both for dev experience and user functionality:
- 🔐 RBAC & Multi-tenancy: Role-based access control
- 🚩 Feature flags: Fine-grained control with Unleash for toggling features live
- ✅ End-to-End testing: CI-based tests using KinD + GitHub Actions for full cluster testing
- 🔍 Workflows & Sagas: Integrate Temporal. Makes multi-step, long-running processes reliable.
- 🔍 Keycloak (OIDC): Centralize identity (SSO, JWT, refresh), model complex permissions.
- CQRS
- 🌀 Canary releases: Progressive delivery with Argo Rollouts
- 🔍 Zero-downtime observability: Auto instrument new services with OTEL SDKs
- 🔍 Schema registry: Integrate Apicurio Registry (version control for message formats)
- 🔍 Secret management: Integrate HashiCorp Vault.
- 🔍 Service mesh: Integrate Linkerd or Istio Ambient.
