1. Courses
  2. Running Software in Production
  3. Capstone

Capstone project for Running Software in Production

Production-readiness review for the Store app API

Mangrove Market's Store app runs on handheld scanners in 320 stores: staff receive deliveries (goods received notes, GRN), count stock and check prices. Its NestJS API is about to get a new GRN scan flow before the festival season. Today the API writes plain-text logs, has no metrics or tracing, and pages the on-call engineer whenever CPU passes 80%. A security review found that GET /v1/grns/:id loads by id only, refresh tokens never expire, and the database password sits in a committed .env file. Deploys are done by hand over SSH, images are tagged latest, and the last release renamed a column and could not be rolled back. Ken, the engineering manager, asks you for a production-readiness review with concrete fixes: how the team will see problems, how each user is limited to their own stores, and how the new GRN flow will reach stores safely.

What you hand in

  1. An observability plan: the SLO for GRN submit, the log fields, the RED and USE metrics with their labels, and what is traced
  2. An alert rules file with one page-level and one ticket-level rule, each with its threshold, hold time, traffic guard and runbook link
  3. A security findings table (finding, risk, fix, owner), plus working code and a test that shows the GRN IDOR is fixed
  4. A release plan: the pipeline stages and gates, the image tag scheme, the migration order for the new flow, and the flag rollout by store
  5. A one-page rollback runbook: the exact commands or switches, and how long each takes

Check your work

Tick each item when your project meets it. Be strict: this is the rubric the reviewer uses.

  • The SLO is a user-facing number with a target and a window, and the latency histogram has a bucket edge at the SLO threshold
  • No metric label holds a user id, order id or full URL; ids go to logs and traces instead
  • The page alert is a symptom tied to the SLO, held for several minutes, with a minimum traffic guard; CPU is on a dashboard, not a page
  • Every GRN query is scoped to the user's sites through one helper, and another store's GRN returns 404
  • Access tokens live minutes, refresh tokens rotate and are stored hashed, and reuse revokes the family
  • Secrets move out of git into a secret store, and the leaked password is rotated
  • Images are tagged with the commit id and built once; migrations run once per release and are safe for the previous code
  • The new flow ships behind a flag with a kill switch, starts with pilot stores, and has a written owner and removal date

0 of 8 checked

Model answer

The model answer opens once your capstone passes the review, so you can compare your work with an outline of a strong submission.

Hand in your capstone

Your links are checked automatically, then the work is scored against the rubric above, item by item, with comments. A pass counts toward the course certificate and shows on your profile.

Loading…