Role-only RBAC
Two clear roles, admin and user, with server-side enforcement for protected workflows.
Production BFF starter
Next.js, Clerk, and private FastAPI in one deployable template.
A clean starting point for Metro Engines internal apps: signed-in UX, role-only admin controls, private backend APIs, and Kubernetes deployment conventions already wired together.
Request path
Public BFF, private API
1
Browser
2
Next.js /api
3
ClusterIP FastAPI
4
MySQL + Redis + S3
Template checklist
- Rename the product, logo, and navigation placeholders.
- Add your domain models behind Next.js API routes.
- Wire new FastAPI routers to the existing auth dependencies.
- Keep FastAPI private and expose only the BFF surface.
BFF API boundary
Browser traffic stays on Next.js /api routes while the backend remains private.
FastAPI backend
JWT verification, health checks, MySQL, Redis, S3 utilities, and admin routes are ready to extend.
Admin console
User, role, invitation, statistics, settings, and API tester screens ship with the template.
Kubernetes path
Private FastAPI service, public Next.js service, shared MySQL, Redis sentinel, and GitHub Actions deploys.
Operational checks
Health endpoints, webhook verification, rate limiting, and cache invalidation are part of the baseline.
Default routes
App dashboard
/dashboardsigned inUsers
/dashboard/admin/usersadminRoles
/dashboard/admin/rolesadminAPI health
/api/healthpublicDesigned for DC1MAIN-2
Next.js is the only public workload
FastAPI stays inside the namespace
Clerk webhooks verify Svix signatures
GitHub Actions builds and deploys k8s branch