MinBase — Build a Production Backend, One Container at a Time

A hands-on course that turns two Docker containers into a secure, multi-tenant, production-ready backend — and makes you understand every line along the way.

Most "backend in 10 minutes" tutorials hand you a black box. MinBase does the opposite: you start with the naive setup everyone actually writes first, then fix it step by step — persistence, reliability, least privilege, secrets, auth, tenant isolation, edge routing, a real frontend — until you've built a stack you'd deploy to a paying customer. Ten steps. Two new ideas each. Every step verified with real requests, including the failure cases.

Built on the tools serious teams already trust: PostgreSQL · PostgREST · Traefik · Nginx · Docker Compose. No proprietary platform. No lock-in. No magic.

Who it's for

Students who know a little Docker, HTTP, and SQL and want to see how the pieces become a real system.
Junior engineers who can wire up a container but have never owned the security, secrets, and multi-tenancy decisions that separate a demo from production.

One course, two depth tracks. Students follow the steps; engineers get the "why" sidebars — SCRAM vs md5, connection-pool limits, UUID vs integer tenant keys, proxy-vs-webserver separation, and the image-specific secret-handling gotchas that bite real deployments.

The ten steps

#	Step	You'll learn
v-b0	Baseline: DB + auto-generated API	What the minimum backend actually is
v-b1	Externalize network + volumes	Resource isolation, data that survives
v-b2	Healthchecks + restart policies	Reliability, correct startup ordering
v-b3	Roles + `authenticator` (no superuser)	Least privilege — the #1 security fix
v-b4	`.env` dev/prod + secrets	Config management, keeping secrets out of git
v-b5	JWT authentication	Auth enforced by the database, not app code
v-b6	Row-Level Security	True multi-tenant isolation
v-b7	Traefik reverse proxy + security headers	Edge routing, hardening, smaller attack surface
v-b8	Nginx SPA server (full-stack)	A real frontend + API on one origin, no CORS
v-b9	Python stored functions as REST endpoints	Non-table `/rpc` endpoints on PostgREST, no second app server

By the end you have a stack that's safe to deploy to a cloud server: least privilege, externalized secrets, JWT auth, RLS tenant isolation, a hardened Traefik edge, a SPA-plus-API topology, and non-table REST endpoints written in Python with no added services — with the intermediate (TLS, DNS, monitoring) and advanced (orchestration, CI/CD, backups) tiers mapped out as your next steps.

What makes it different

You break it, then fix it. v-b0 ships the superuser-in-the-API anti-pattern on purpose — so when you fix it in v-b3, you understand why it mattered.
Real-world gotchas included. The course teaches things tutorials skip: why the PostgREST ignores PGRST_*_FILE but reads @/path values, why a Traefik middleware silently disables a route, why try_files saves your SPA on refresh.
Proven, not asserted. Every step ends with real curl/psql checks — including the failure mode. And the claims below aren't config-only: each variant ships a verify.sh that ran green.
- Host hardening — SSH key-only, root login refused, UFW 22/80/443, fail2ban jail (v-i1 ✔)
- Real DNS — the same Compose file serves local and production, zero compose changes (v-i2 ✔)
- Real TLS — auto-issued and auto-renewed Let's Encrypt via Traefik ACME, HTTP→HTTPS + HSTS (v-i3 ✔)
- Secrets encrypted at rest — SOPS + age: ciphertext committed to git, nothing visible to docker inspect (v-i4 ✔)
- Observability + network segmentation — provisioned Grafana, four isolated networks, DB unreachable from the monitoring tier (v-i5 ✔)
- Multi-tenancy isolation — cross-tenant reads empty, writes 403, expired/tampered tokens rejected (v-b6 ✔)
- Full-stack edge — one origin, no CORS, security headers; Python /rpc endpoints incl. in-DB-minted JWTs (v-b8/v-b9 ✔)
No lock-in, ever. It's PostgreSQL and open-source infrastructure the whole way. What you learn transfers to any job, any cloud, any scale.

The stack, by the numbers

PostgreSQL, PostgREST, Traefik, and Nginx are among the most battle-tested, widely-starred open-source projects in backend infrastructure — the same components running in production at companies you've heard of. MinBase teaches you to compose them yourself instead of paying a platform to hide them from you.

What that buys you, by construction:

No lock-in. The API contract is your own database schema — PostgREST auto-generates endpoints from it, so any layer can be swapped without touching your application code.
No black box. Eight battle-tested open-source components (Postgres, PostgREST, Traefik, Nginx, Docker, Compose, plus SOPS and Prometheus at the edges). Nothing stands between your request and your database.
Security in the database, not the app. Row-Level Security, least-privilege roles, and JWT auth hold tenant isolation even when the client is untrusted — or an agent.
Self-hosted on your own infrastructure. No vendor runtime, no metering, no account. Your only cost is the compute you already run.
Endpoints don't have to be tables. Non-DB logic runs as Python stored functions — /rpc routes on the same PostgREST, same Traefik edge, no second app server.

"Every developer should be able to build and deploy a production backend in under 10 minutes — with full understanding and control of their stack."

Get the free starter repo (v-b0) · Buy the full ten-step course · Deploy-to-VPS capstone included.