System design of the Beyou app - domain model, data flow, security boundaries and the diagrams behind each decision.
How Beyou runs in production: four client surfaces, one Spring Boot API, PostgreSQL, an image pipeline out of GitHub, and the monitoring that watches all of it.
Production is a 2012-era laptop in a bedroom: Debian 13, a single-node k3s cluster run by Flux from Git, a Cloudflare Tunnel dialing out, and zero ports open to the internet.
Prometheus, Grafana, Loki and GlitchTip: a shared platform stack in the production cluster and a Compose overlay for local development. How each question gets answered, and how a human gets told.
Every entity in Beyou: the core loop of habits, tasks, goals, and routines, plus the history, snapshot, Focus Mode, mood, calendar, Ideas board, study notebook, feedback, and AI chat families built around it.
The XP formula, the quadratic level curve, two streak systems that only break on a real miss, decayed late check-ins, the signed daily ledger that makes every number auditable, how the account's own timezone decides which day any of it lands on, the study notebook's three pay-once rewards, and the flat ten a calendar task pays.
Authentication, tokens, rate limiting, ownership checks, upload hardening, the study notebook's SSRF-refusing link fetcher, AI agent guardrails, and the boot-time validators that refuse a misconfigured production.
A chat agent with 78 real tools, streamed over SSE, running on a configurable LLM fallback chain, with three memory layers and guardrails that assume the model will misbehave.
How the Caffeine layer works across the backend: three cache tiers, the per-user eviction strategy and its one global exception, the domains that are deliberately not cached, and the caches that live outside Spring's manager.
How these very pages travel: markdown in a Git repo, an authenticated import into Postgres, a public API, and a prerendered static site that rebuilds itself on every content push.
Eight e-mails, one service class: six transactional, one reminder the user set up and one that nobody asked for, how each decouples from its database transaction, the limits standing between a trigger and an inbox, and why the nudge sender ships switched off while the reminder sender does not.
Two aspects give every controller and service consistent logging, timing, and error routing, tuned so client mistakes stay quiet and real faults stay loud, and every line stamped with the id of the user it belongs to.
One TypeScript codebase, two clients: how the web app and the native mobile app share their state, API layer, themes, translations, and validation as raw source, and where they deliberately part ways.
How the web app is organized inside the monorepo: the shared shell, the entity component quartet, the widget system, the two-part tutorial, and the code-splitting that keeps first load small.
One state package shared by web and mobile: 22 slices, a PII-aware persistence blacklist, versioned persisted state, the shared gamification apply function, and the two-tier HTTP layer underneath.
The client side of the trust boundary: in-memory tokens, the silent-refresh boot, an admin gate that refuses to trust the client, PII-aware persistence, and the headers Cloudflare serves in front of it all.
Two languages and a two-base, five-accent theme system: shared token packages, a mode:pack preference string, live OS following, and the migration that retired the nine old themes.
PostHog across four surfaces behind one first-party proxy: the event vocabulary named after engagement triggers rather than buttons, the person properties the cohorts are built from, what never leaves the browser, and how adblockers shaped the transport.
Topics laid out as roadmap boards, a page of notes behind every node, an AI that answers from the person's own notes and sources with citations and draws diagrams the notebook keeps, flashcards on a spaced schedule, and study cycles that rotate topics through a queue of time and goal blocks. The model, its rules, and the class that owns each one.