Kuybi

Why it exists

Most NestJS starters cover routing and a database connection, then leave access control, audit logging, caching and observability as an exercise for every team that adopts them. Kuybi bakes those in from the start, so a new service begins with role-based access control, a compliance-ready audit trail, Redis caching and production monitoring already wired up, instead of rebuilding the same foundation each time.

What it's suited for

Editorial / content platforms

Draft → review → scheduled-publish workflows, taxonomy, tagging and media attachments are already modeled.

Internal tools with real access control

Anything that needs department- or role-scoped permissions and an audit trail from day one, not bolted on later.

Media / asset-heavy backends

Pre-signed S3 upload/download flows and image handling are already wired up.

Headless API backend

Swagger-documented REST endpoints with JWT auth, ready to sit behind any frontend or mobile client.

Features

Dual-token JWT auth

Access/refresh token rotation with Redis-backed session revocation and multi-session (device) tracking.

RBAC/ABAC access control

Fine-grained permissions via CASL, including field-level rules and time-based role expiration.

Audit logging

Logs user, action, entity, change payload, IP and user-agent for every sensitive operation.

Redis caching

Repository-level caching with automatic pattern-based invalidation on writes; the maintainer reports 25–80x faster reads than an uncached query.

BullMQ background jobs

Queue processing runs in a dedicated worker process, with a Bull Board dashboard for queue health.

Production observability

Sentry error tracking, Prometheus metrics, OpenTelemetry tracing and Terminus health checks out of the box.

Stack

• NestJS · 11
• TypeScript · 5
• PostgreSQL · 16
• TypeORM · 0.3
• Redis · 7 (ioredis)
• BullMQ · queue + Bull Board
• Pino · logging
• Sentry · error tracking
• Prometheus · metrics
• OpenTelemetry · tracing
• AWS S3 · SDK v3

Architecture

Built with Domain-Driven Design: core/ for cross-cutting infrastructure (cache, config, database, health, logging, observability, queues), infrastructure/ for third-party integrations (email, S3), modules/ for feature domains (acl, attachments, audit, auth, categories, countries, post-types, stories, tags, users, web) and shared/ for cross-module decorators, guards, filters and interceptors. Three entrypoints: main.ts (HTTP API), worker.ts (background queue processing) and dashboard.ts (Bull Board, port 4050) run as separate processes.

Security

Every request passes through the same pipeline before it reaches a controller:

1. 1.Helmet security headers, CORS and global rate limiting (@nestjs/throttler)
2. 2.JWT auth guard with access/refresh rotation and blacklist check
3. 3.RBAC/ABAC guard (CASL) evaluated per request
4. 4.DTO validation with strict payload whitelisting, plus HTML sanitization (isomorphic-dompurify) against XSS
5. 5.Audit logging interceptor on the controller action itself

Quick start

git clone https://github.com/moayyadfaris/Kuybi.git
cd Kuybi
npm install
cp .env.example .env
npm run start:dev

Full setup (PostgreSQL, Redis, migrations and seed data) is documented in the repo README.

Roadmap

• Expand test coverage across core modules
• Publish setup and architecture documentation
• Evaluate a paid "Pro" tier (extended boilerplate, commercial license, priority support) once the free version has real adoption