API gateway
ADR 0001 selects Kong Gateway OSS 3.8 in PostgreSQL DB mode (schema kong). Git file splick-backend/infra/kong/kong.yml is the source of truth. Bootstrap and restart in infra/docker/manage*.sh apply it. Local proxy 8080. Admin API 127.0.0.1:8001 only.
What Kong does
- Strips the
/apiprefix with a pre-function plugin so upstreams see/v1/.... - Injects
X-Request-Id(correlation-id plugin) and echoes it on the response. - Applies route-level rate limits (login, OTP, refresh, register, social, feed, and others).
- Exposes Prometheus metrics on port 9542.
- Allows long timeouts on the messaging route so WebSocket upgrades survive.
What Kong does not do
- It does not validate JWTs or own OAuth.
- It does not route to the outbox relay.
Route map
| Upstream | Port | Public prefixes |
|---|---|---|
| auth-service | 8081 | /api/v1/auth, /api/v1/admin/** auth and trial and ops |
| social-service | 8082 | /api/v1/social, /api/social, /api/v1/public/users |
| expense-service | 8083 | /api/v1/expenses, /api/v1/public/bills, /api/v1/bills |
| feed-service | 8084 | /api/v1/feed, /api/v1/public/posts, /api/v1/app, /api/v1/stickers, admin posts and releases |
| media-service | 8085 | /api/v1/media, /api/v1/music |
| notification-service | 8086 | /api/v1/notifications, /api/v1/devices |
| communication-service | 8087 | preview, delivery logs, usage, provider webhooks |
| messaging-service | 8088 | /api/v1/messaging |
Production hostname api.splick.app terminates at Cloudflare and reaches Kong on the VPS. Keep the api DNS record on the API host. The website DNS is a different Pages project. See production deploy.