System design of the Beyou app - domain model, data flow, security boundaries and the diagrams behind each decision.
How Beyou runs in production: four client surfaces, one Spring Boot API, PostgreSQL, an image pipeline out of GitHub, and the monitoring that watches all of it.
Production is a 2012-era laptop in a bedroom: Debian 13, Docker, a Cloudflare Tunnel dialing out, and zero ports open to the internet.
Prometheus, Grafana, Loki and GlitchTip as one Compose overlay: how each question gets answered, how the collector alerts a human, and why the whole thing is identical in dev and production.
Every entity in Beyou: the core loop of habits, tasks, goals, and routines, plus the history, snapshot, feedback, and AI chat families built around it.
The XP formula, the quadratic level curve, two streak systems that only break on a real miss, decayed late check-ins, the signed daily ledger that makes every number auditable, and how the account's own timezone decides which day any of it lands on.
Authentication, tokens, rate limiting, ownership checks, upload hardening, AI agent guardrails, and the boot-time validators that refuse a misconfigured production.
A chat agent with 33 real tools, streamed over SSE, running on a configurable LLM fallback chain, with three memory layers and guardrails that assume the model will misbehave.
How the Caffeine layer works across the backend: three cache tiers, the per-user eviction strategy and its one global exception, and the caches that live outside Spring's manager.
How these very pages travel: markdown in a Git repo, an authenticated import into Postgres, a public API, and a prerendered static site that rebuilds itself on every content push.
Seven e-mails, one service class: six transactional and one that nobody asked for, how each decouples from its database transaction, the three limits standing between a nudge trigger and an inbox, and why the sender ships switched off.
Two aspects give every controller and service consistent logging, timing, and error routing, tuned so client mistakes stay quiet and real faults stay loud, and every line stamped with the id of the user it belongs to.
One TypeScript codebase, two clients: how the web app and the native mobile app share their state, API layer, themes, translations, and validation as raw source, and where they deliberately part ways.
How the web app is organized inside the monorepo: the shared shell, the entity component quartet, the widget system, the two-part tutorial, and the code-splitting that keeps first load small.
One state package shared by web and mobile: 17 slices, a PII-aware persistence blacklist, the shared gamification apply function, and the two-tier HTTP layer underneath.
The client side of the trust boundary: in-memory tokens, the silent-refresh boot, an admin gate that refuses to trust the client, PII-aware persistence, and the headers nginx serves in front of it all.
Two languages and a two-base, five-accent theme system: shared token packages, a mode:pack preference string, live OS following, and the migration that retired the nine old themes.
PostHog across four surfaces behind one first-party proxy: the event vocabulary named after engagement triggers rather than buttons, the person properties the cohorts are built from, what never leaves the browser, and how adblockers shaped the transport.