Skip to main content

System context

People use the iOS app, the Android app, or the website. All three call the same HTTPS API. Operators use Grafana and the admin web console. Push goes out through APNs and optionally FCM. Email goes out through the configured provider (Resend, Brevo, Mailjet, Mailtrap, SendPulse, or SMTP). Media bytes go to Cloudflare R2. The public website is a separate Cloudflare Pages project.

Splick does not run a second public API for mobile. Admin routes are still behind Kong under /api/v1/admin/** with their own auth.

What is intentionally out of the system​

  • No distributed transaction across services.
  • No cross-schema SQL joins.
  • No JWT verification inside Kong. Auth stays in auth-service; other services verify the signature with the public key.