Backend Developer

A step-by-step path from how HTTP works to running monitored services in production. Every stage uses Node.js and TypeScript, but the ideas carry over to Go, Python or any other server language.

9 stages56 topicsAbout 7-9 months at 10 hours a week

Before you start: Basic JavaScript (variables, functions, arrays, objects) and the ability to install software on your own machine. No backend, database or networking experience is needed: the first stage covers the web and terminal basics that everything else builds on.
Where it gets you: You can design, build, test and deploy a secure, documented API backed by PostgreSQL and Redis, run background jobs, and keep it healthy in production with logs, metrics and traces. That covers what most junior and mid-level backend job posts ask for.

0 of 56 topics done

Tick a topic once you can explain it and have used it in a project. Progress is saved in this browser.

Core
Recommended
Optional
Done

1
How the Web Works and Your Toolkit
About 2-3 weeks0/5
Explain what happens between typing a URL and getting a response, and work comfortably in a terminal with Git.
Build: URL Inspector Script
Write a shell script that takes a URL and prints its DNS records, TLS certificate issuer and expiry, status code and response headers. Keep it in a GitHub repo with a README that explains each line of output.
2
Node.js and TypeScript in Depth
About 4-6 weeks0/7
Write non-blocking, typed Node.js programs and explain how the event loop runs them.
Build: Streaming Log Analyzer
Build a TypeScript CLI that streams a multi-gigabyte access log and reports status code counts and the slowest endpoints while memory stays flat. Add a flag that moves parsing into a worker thread and compare the timings.
3
Building HTTP APIs
About 3-4 weeks0/6
Design and build a documented REST API with validation, clear errors and pagination.
Build: Bookmarks API
Build a REST API for saving bookmarks with CRUD routes, Zod validation, cursor pagination, tag filtering and Problem Details errors, keeping data in memory for now. Publish an OpenAPI spec and serve interactive docs at /docs.
4
Databases and Data Modeling
About 5-6 weeks0/7
Model data in PostgreSQL, write efficient queries, and choose when a document store or Redis fits better.
Build: Bookmarks on PostgreSQL
Move the bookmarks API to PostgreSQL with users, tags as a many-to-many relation, versioned migrations and seed data. Add a bulk import endpoint that runs in one transaction, and use EXPLAIN ANALYZE to justify every index you add.
5
Authentication, Authorization and Security
About 3-4 weeks0/7
Add secure login, token handling and permission checks, and defend an API against the most common attacks.
Build: Auth for the Bookmarks API
Add signup and login with Argon2id hashes, short-lived access tokens, rotating refresh tokens in HttpOnly cookies, and admin-only routes. Rate limit the login route and write a test proving a reused refresh token is rejected.
6
Caching, Background Jobs and Real-Time
About 3-4 weeks0/6
Make slow reads fast, move slow work off the request path, and push live updates to clients.
Build: Link Preview Service
Add an endpoint that accepts a URL with an idempotency key, queues a BullMQ job that fetches the page title and image with timeouts and retries, and caches results in Redis. Stream job completion to the browser over Server-Sent Events.
7
Testing and Code Quality
About 2-3 weeks0/5
Prove your API works with fast unit tests and realistic integration tests, and keep the codebase consistent.
Build: Test Suite for the Bookmarks API
Write unit tests for the service layer and an integration suite that starts PostgreSQL and Redis in containers and hits every route with Supertest, including auth failures. Make one command run the whole suite on a clean machine.
8
Architecture and Scaling
About 4-5 weeks0/7
Structure a growing codebase, reason about system design trade-offs, and find and remove performance bottlenecks.
Build: Modular Bookmarks Platform
Reorganize the API into users, bookmarks and notifications modules with controller, service and repository layers, where bookmark events reach notifications through an outbox table and a worker. Load test the list endpoint before and after your caching and pooling changes and record the p95 results in the README.
9
Shipping and Running in Production
About 3-4 weeks0/6
Package, deploy and monitor a backend service, and know what to do when it breaks.
Build: Production Launch
Containerize the bookmarks platform and deploy it with managed PostgreSQL and Redis through a GitHub Actions pipeline, on a custom domain with HTTPS. Add JSON logs, OpenTelemetry traces, health checks and a written rollback plan, then break something on purpose and find it through the traces.
Where it gets you
You can design, build, test and deploy a secure, documented API backed by PostgreSQL and Redis, run background jobs, and keep it healthy in production with logs, metrics and traces. That covers what most junior and mid-level backend job posts ask for.

Core must know for the roleRecommended expected in most jobsOptional for specific teams or later

1
How the Web Works and Your Toolkit
About 2-3 weeks
Explain what happens between typing a URL and getting a response, and work comfortably in a terminal with Git.
- Internet and Networking Basics
  Core
  Every backend call rides on IP, TCP and ports, so knowing them makes timeouts and connection errors much easier to debug.
  - Clients, servers and IP addresses
  - TCP vs UDP and ports
  - What localhost and 0.0.0.0 mean
  - Latency, bandwidth and round trips
  - Proxies and load balancers, briefly
  - MDN: How the Internet works
- HTTP in Practice
  Core
  HTTP is the contract between your API and its clients, so you need to read and write it fluently before building anything.
  - Request line, headers and body
  - GET, POST, PUT, PATCH, DELETE
  - Status code classes 2xx to 5xx
  - Content-Type and content negotiation
  - Cookies and the Set-Cookie header
  - CORS and preflight requests
  - HTTP/2 and HTTP/3 at a glance
  - Inspecting traffic with curl -v
  - MDN: Overview of HTTP
  - MDN: HTTP status codes
- DNS, Domains and TLS
  Core
  Deploying anything means pointing a domain at a server and serving it over HTTPS, which depends on DNS and TLS.
  - A, AAAA, CNAME, MX, TXT records
  - TTLs and propagation delays
  - Looking up records with dig
  - TLS handshake and certificates
  - Certificate authorities and Let's Encrypt
  - Why HTTPS is mandatory
  - MDN: What is a domain name
  - Let's Encrypt: How it works
- Linux Shell Basics
  Core
  Servers, containers and CI runners are Linux machines driven from a shell, so terminal fluency pays off in every later stage.
  - Navigating and editing files
  - Permissions and ownership
  - Pipes, redirects and grep
  - Processes, signals and open ports
  - Environment variables and PATH
  - SSH keys and remote login
  - Installing packages with apt
  - Ubuntu: Command line for beginners
  - GNU Bash manual
- Git and GitHub Workflow
  Core
  Every team ships code through Git, and clean commits and pull requests are how reviewers judge your work.
  - Commits, staging and history
  - Branches, merge and rebase
  - Resolving merge conflicts
  - Remotes, push and pull
  - Pull requests and code review
  - .gitignore and keeping secrets out
  - Pro Git book
  - GitHub docs: Pull requests
Build: URL Inspector Script
Write a shell script that takes a URL and prints its DNS records, TLS certificate issuer and expiry, status code and response headers. Keep it in a GitHub repo with a README that explains each line of output.
2
Node.js and TypeScript in Depth
About 4-6 weeks
Write non-blocking, typed Node.js programs and explain how the event loop runs them.
- Modern JavaScript for Servers
  Core
  Backend code is mostly async data handling, so promises, errors and modern syntax need to feel natural before you touch a framework.
  - Closures and scope
  - Promises and async/await
  - Promise.all and Promise.allSettled
  - try/catch and custom Error classes
  - Destructuring, spread, optional chaining
  - map, filter and reduce
  - Classes vs plain objects
  - MDN: Using promises
  - MDN: async function
- The Node.js Runtime and Event Loop
  Core
  Node.js runs your code on one main thread, so knowing how the event loop schedules work tells you what makes a server slow.
  - Installing Node.js 24 LTS
  - Call stack and event loop phases
  - Microtasks vs timers and I/O callbacks
  - libuv thread pool
  - Why CPU-heavy code blocks requests
  - process, argv and exit codes
  - Node.js: The event loop
  - Node.js: Don't block the event loop
- Modules and npm
  Core
  Real projects are built from packages, so you need to structure modules and manage dependencies without breaking builds or inviting supply chain attacks.
  - ES modules vs CommonJS
  - package.json fields and scripts
  - Semantic versioning ranges
  - Lockfiles and npm ci
  - npm audit and updating dependencies
  - Workspaces for multi-package repos
  - Node.js docs: Packages
  - npm docs: Semantic versioning
- Streams, Buffers and Files
  Core
  Streams let a server handle large files and uploads with constant memory, which comes up in both interviews and production incidents.
  - Buffers and character encodings
  - Readable, writable and transform streams
  - stream.pipeline and error handling
  - Backpressure and highWaterMark
  - Async iteration over streams
  - fs/promises for file work
  - Node.js docs: Stream
  - Node.js: Backpressuring in streams
- TypeScript for Backend Code
  Core
  Most Node.js backend jobs now expect TypeScript, and strict types catch whole classes of bugs before they reach production.
  - strict mode and tsconfig basics
  - Interfaces, type aliases and unions
  - Narrowing and discriminated unions
  - Generics for reusable helpers
  - Running .ts files with type stripping
  - tsc --noEmit as a CI check
  - TypeScript Handbook
  - Node.js docs: TypeScript
- Node.js Built-in Modules
  Recommended
  Node.js ships with tools for files, crypto, HTTP and config, so you can skip extra dependencies for many common tasks.
  - node:http server without a framework
  - node:crypto for hashes and IDs
  - Built-in fetch and AbortController
  - Loading config with --env-file
  - Restarting on change with --watch
  - worker_threads for CPU-bound work
  - Node.js API docs
  - Node.js docs: Worker threads
- A Second Language: Go or Python
  Optional
  Once Node.js feels solid, a second language shows which backend ideas are universal and widens the jobs you can apply for.
  - Go: goroutines and net/http
  - Python: FastAPI or Django basics
  - Compare concurrency models with Node.js
  - Rebuild one small API
  - A Tour of Go
  - The Python Tutorial
Build: Streaming Log Analyzer
Build a TypeScript CLI that streams a multi-gigabyte access log and reports status code counts and the slowest endpoints while memory stays flat. Add a flag that moves parsing into a worker thread and compare the timings.
3
Building HTTP APIs
About 3-4 weeks
Design and build a documented REST API with validation, clear errors and pagination.
- Express 5 Fundamentals
  Core
  Express is the most widely used Node.js web framework, and its routing and middleware patterns carry over to Fastify, NestJS and Hono.
  - App, Router and route handlers
  - Route params, query and body
  - JSON body parsing and size limits
  - Async handlers and rejected promises
  - Express 5 path syntax changes
  - trust proxy behind load balancers
  - Express: Routing
  - Express: Moving to Express 5
- Middleware and Error Handling
  Core
  Middleware adds logging, auth and parsing once for every route, and a single error handler keeps failures consistent.
  - Middleware order and next()
  - Request IDs and request logging
  - Custom error classes with status codes
  - One central error handler
  - Consistent JSON error shape
  - 404 handler for unknown routes
  - Express: Using middleware
  - Express: Error handling
- REST API Design
  Core
  A predictable API is easier to use, cache and change later, so design conventions matter as much as the code behind them.
  - Resources as nouns, methods as verbs
  - Correct status codes per outcome
  - Safe and idempotent methods
  - Offset vs cursor pagination
  - Filtering, sorting and field selection
  - Versioning by URL or header
  - Problem Details error format
  - MDN: HTTP request methods
  - RFC 9457: Problem Details
- Validation with Zod
  Core
  Never trust input: validating every request at the edge blocks bad data and gives you TypeScript types for free.
  - Schemas for body, query and params
  - safeParse and readable error messages
  - Inferring types from schemas
  - Coercing query string values
  - Validating env variables at startup
  - Reusable validation middleware
  - Zod docs
- API Documentation with OpenAPI
  Recommended
  OpenAPI turns your API into a machine-readable contract that powers docs, client generation and contract tests.
  - Paths, operations and components
  - Request and response schemas
  - Generating specs from Zod schemas
  - Serving interactive docs
  - Generating typed API clients
  - OpenAPI Specification
- GraphQL and gRPC
  Optional
  Some teams use GraphQL for flexible frontend queries or gRPC for fast service-to-service calls, so know when each one fits.
  - GraphQL schema, queries, mutations
  - Resolvers and the N+1 problem
  - Batching with DataLoader
  - gRPC with Protocol Buffers
  - Unary vs streaming RPCs
  - When plain REST is enough
  - GraphQL: Learn
  - gRPC: Introduction
Build: Bookmarks API
Build a REST API for saving bookmarks with CRUD routes, Zod validation, cursor pagination, tag filtering and Problem Details errors, keeping data in memory for now. Publish an OpenAPI spec and serve interactive docs at /docs.
4
Databases and Data Modeling
About 5-6 weeks
Model data in PostgreSQL, write efficient queries, and choose when a document store or Redis fits better.
- SQL with PostgreSQL
  Core
  PostgreSQL is the default relational database for most new backends, and raw SQL skill outlasts any ORM you pick.
  - SELECT, WHERE, ORDER BY, LIMIT
  - INNER and LEFT JOINs
  - GROUP BY and aggregates
  - Subqueries and CTEs
  - Upserts with ON CONFLICT
  - Window function basics
  - JSONB columns and queries
  - PostgreSQL docs: Tutorial
  - PostgreSQL docs: WITH queries
- Relational Data Modeling
  Core
  Good schemas prevent bugs that no application code can fix, so model tables and relationships before writing queries.
  - Entities and relationships
  - Primary keys: identity vs UUID
  - Foreign keys and cascades
  - One-to-many and many-to-many
  - Normalization up to 3NF
  - NOT NULL, UNIQUE, CHECK constraints
  - When to denormalize
  - PostgreSQL docs: Constraints
- Indexes and Query Performance
  Core
  Most slow endpoints trace back to a missing index or a bad query, and reading query plans is how you prove the fix.
  - B-tree index basics
  - Composite index column order
  - Reading EXPLAIN ANALYZE output
  - Spotting N+1 queries
  - Partial and expression indexes
  - Write cost of extra indexes
  - PostgreSQL docs: Indexes
  - PostgreSQL docs: Using EXPLAIN
- Transactions and Concurrency
  Core
  When two requests change the same data at once, transactions and locks decide whether your data stays correct.
  - ACID properties
  - BEGIN, COMMIT and ROLLBACK
  - Isolation levels and anomalies
  - Row locks with FOR UPDATE
  - Optimistic locking with version columns
  - Deadlocks and retrying transactions
  - PostgreSQL docs: Transactions
  - PostgreSQL docs: Transaction isolation
- ORMs, Query Builders and Migrations
  Core
  Teams change schemas through versioned migrations and usually query through Prisma or Drizzle, so learn one well and know its limits.
  - Schema definition in Prisma or Drizzle
  - Generating and applying migrations
  - Seeding development data
  - Parameterized queries against injection
  - Dropping to raw SQL when needed
  - Safe migrations on live tables
  - Prisma docs: How migrations work
  - Drizzle docs: Migrations
- MongoDB and Document Data
  Recommended
  Many Node.js teams, especially MERN shops, run MongoDB, and document modeling follows different rules than tables.
  - Documents, collections and BSON
  - Embedding vs referencing
  - Indexes in MongoDB
  - Aggregation pipeline basics
  - Schemas with Mongoose
  - When relational fits better
  - MongoDB docs: Data modeling
  - MongoDB docs: Aggregation
- Redis as a Data Store
  Core
  Redis is the usual in-memory store for caches, sessions, rate limits and queues, so learn its data types before using it in later stages.
  - Strings, hashes, lists and sets
  - Sorted sets for rankings
  - Key expiry with TTLs
  - Atomic counters with INCR
  - Pub/sub basics
  - Persistence and memory limits
  - Redis docs: Data types
Build: Bookmarks on PostgreSQL
Move the bookmarks API to PostgreSQL with users, tags as a many-to-many relation, versioned migrations and seed data. Add a bulk import endpoint that runs in one transaction, and use EXPLAIN ANALYZE to justify every index you add.
5
Authentication, Authorization and Security
About 3-4 weeks
Add secure login, token handling and permission checks, and defend an API against the most common attacks.
- Storing Passwords Safely
  Core
  Leaked password tables are a classic breach, so hash passwords correctly from the very first login you build.
  - Hashing vs encryption
  - Argon2id or bcrypt with salts
  - Tuning work factors
  - Secure password reset tokens
  - Constant-time comparisons
  - Generic login error messages
  - OWASP: Password Storage Cheat Sheet
- Sessions, JWTs and Refresh Tokens
  Core
  Choosing between server sessions and tokens, and storing them safely, is one of the most common backend design questions.
  - Server-side sessions with cookies
  - HttpOnly, Secure, SameSite flags
  - JWT structure and signature checks
  - Short-lived access tokens
  - Refresh token rotation and reuse detection
  - Logout and token revocation
  - CSRF protection for cookie auth
  - OWASP: Session Management Cheat Sheet
  - OAuth.net: Refresh tokens
- OAuth 2.0 and OpenID Connect
  Recommended
  Social login and third-party API access both run on OAuth 2.0 and OIDC, so understand the flows even when a provider does the work.
  - Client, resource and authorization servers
  - Authorization code flow with PKCE
  - Scopes and consent
  - ID tokens vs access tokens
  - Validating tokens from a provider
  - Hosted identity providers
  - OAuth 2.0 overview
  - OAuth.net: PKCE
- Authorization and Access Control
  Core
  Broken access control tops the OWASP Top 10, so every route needs an explicit check of who may do what.
  - Authentication vs authorization
  - Role-based access control
  - Resource ownership checks
  - Deny by default
  - Central permission helpers
  - Multi-tenant data isolation
  - OWASP: Authorization Cheat Sheet
- OWASP Top 10 and API Risks
  Core
  Knowing the most common vulnerabilities lets you avoid them while coding instead of patching them after an incident.
  - Injection and parameterized queries
  - Misconfiguration and security headers
  - Software supply chain failures
  - SSRF when fetching user URLs
  - Strict CORS allowlists
  - Mass assignment and data exposure
  - Safe error messages in production
  - OWASP Top 10:2025
  - OWASP API Security Top 10
- Rate Limiting and Abuse Protection
  Core
  Public APIs get scraped, brute-forced and flooded, so limits protect both your users and your infrastructure bill.
  - Fixed window vs token bucket
  - Limits per IP, user and key
  - Shared counters in Redis
  - 429 with a Retry-After header
  - Login brute-force protection
  - Body size and timeout limits
  - MDN: 429 Too Many Requests
- Secrets and Configuration
  Core
  Keys leaked in a repo are one of the fastest routes to a breach, so keep configuration outside the code and secrets out of Git.
  - Config from environment variables
  - .env files only for local dev
  - Cloud secret managers
  - Rotating keys and tokens
  - Secret scanning on repositories
  - Least-privilege database users
  - OWASP: Secrets Management Cheat Sheet
  - GitHub docs: Secret scanning
Build: Auth for the Bookmarks API
Add signup and login with Argon2id hashes, short-lived access tokens, rotating refresh tokens in HttpOnly cookies, and admin-only routes. Rate limit the login route and write a test proving a reused refresh token is rejected.
6
Caching, Background Jobs and Real-Time
About 3-4 weeks
Make slow reads fast, move slow work off the request path, and push live updates to clients.
- HTTP Caching
  Recommended
  The cheapest request is one your server never sees, and HTTP caching headers let browsers and CDNs answer for you.
  - Cache-Control directives
  - ETag and If-None-Match
  - 304 Not Modified responses
  - Public vs private caching
  - CDN caching and purging
  - MDN: HTTP caching
- Caching with Redis
  Core
  Caching hot reads in Redis takes load off the database, but it only works if you plan for invalidation and stale data.
  - Cache-aside pattern
  - Choosing TTLs per data type
  - Invalidating on writes
  - Key naming and versioning
  - Preventing cache stampedes
  - Measuring hit rate
  - Redis docs: Node.js client
- Queues and Background Jobs
  Core
  Emails, image processing and third-party calls should not block a request, so push them to a queue and process them in workers.
  - Producers, queues and workers
  - BullMQ on top of Redis
  - Retries with exponential backoff
  - Handling permanently failed jobs
  - Worker concurrency and rate limits
  - Scheduled and repeating jobs
  - Workers as separate processes
  - BullMQ docs
  - BullMQ docs: Retrying failed jobs
- Webhooks and Idempotency
  Core
  Payment and integration providers deliver events by webhook and retry on failure, so your handlers must be verifiable and safe to run twice.
  - Acknowledge webhooks fast, process later
  - Verifying HMAC signatures
  - At-least-once delivery
  - Idempotency keys on POST requests
  - Deduplicating with unique constraints
  - Sending webhooks with retries
  - GitHub docs: Validating webhook deliveries
  - MDN: Idempotent
- Real-time with WebSockets and SSE
  Recommended
  Chat, notifications and live dashboards need the server to push data, and the choice between polling, SSE and WebSockets affects how you scale.
  - Polling vs SSE vs WebSockets
  - Server-Sent Events for one-way streams
  - WebSocket connection lifecycle
  - Authenticating socket connections
  - Heartbeats and reconnection
  - Fan-out across servers with Redis
  - MDN: WebSockets API
  - MDN: Using server-sent events
- Calling External Services and AI APIs
  Recommended
  Backends now call payment, email and AI model APIs all the time, and those calls need timeouts and retries so one slow provider cannot take you down.
  - Timeouts with AbortSignal.timeout
  - Retries with backoff and jitter
  - Circuit breakers for failing services
  - Streaming AI model responses
  - Respecting provider rate limits
  - Tracking cost and token usage
  - MDN: AbortSignal.timeout()
Build: Link Preview Service
Add an endpoint that accepts a URL with an idempotency key, queues a BullMQ job that fetches the page title and image with timeouts and retries, and caches results in Redis. Stream job completion to the browser over Server-Sent Events.
7
Testing and Code Quality
About 2-3 weeks
Prove your API works with fast unit tests and realistic integration tests, and keep the codebase consistent.
- Unit Testing
  Core
  Unit tests pin down business rules so you can refactor with confidence, and most teams expect them in every pull request.
  - Node.js test runner or Vitest
  - Arrange, act, assert
  - Testing pure service logic
  - Mocks, stubs and fakes at boundaries
  - Testing error paths
  - Coverage as a guide only
  - Node.js docs: Test runner
  - Vitest guide
- Integration Tests with Real Dependencies
  Core
  Many backend bugs live where code meets the database or the HTTP layer, so test those paths against real services instead of mocks.
  - HTTP tests with Supertest
  - Real PostgreSQL via Testcontainers
  - Resetting data between tests
  - Test data factories
  - Testing protected routes
  - Running test files in parallel safely
  - Testcontainers for Node.js
  - Supertest
- Contract and Schema Tests
  Optional
  When several services or apps depend on your API, contract tests catch breaking changes before they are deployed.
  - Validating responses against OpenAPI
  - Consumer-driven contracts with Pact
  - Detecting breaking schema changes
  - Running contract checks in CI
  - Pact docs
- Linting, Formatting and Type Checks
  Core
  Automated checks settle style debates and catch bugs early, leaving code review free for design and logic.
  - ESLint with typescript-eslint
  - Prettier for formatting
  - Strict tsc checks
  - Pre-commit hooks for fast checks
  - Small, reviewable pull requests
  - ESLint docs
  - typescript-eslint: Getting started
- Debugging Node.js
  Recommended
  Reading stack traces and stepping through code with a debugger finds bugs far faster than scattering console.log calls.
  - Reading stack traces
  - node --inspect with Chrome DevTools
  - Breakpoints in VS Code
  - Source maps for TypeScript
  - Reproducing bugs as failing tests
  - Node.js: Debugging
Build: Test Suite for the Bookmarks API
Write unit tests for the service layer and an integration suite that starts PostgreSQL and Redis in containers and hits every route with Supertest, including auth failures. Make one command run the whole suite on a clean machine.
8
Architecture and Scaling
About 4-5 weeks
Structure a growing codebase, reason about system design trade-offs, and find and remove performance bottlenecks.
- Layered Application Structure
  Core
  Separating HTTP handling, business logic and data access keeps code testable and lets you swap pieces without rewrites.
  - Controllers, services and repositories
  - Feature-based folder structure
  - Dependency injection via constructors
  - Keeping Express out of business logic
  - DTOs and mapping between layers
- Modular Monoliths and Microservices
  Recommended
  Most teams do best starting with a well-structured monolith, and knowing when a split into services is worth the cost is a key design judgment.
  - Module boundaries in one codebase
  - The cost of network calls
  - Signs a module should split out
  - API gateways and service discovery
  - Data ownership per service
- Event-driven Design
  Recommended
  Publishing events decouples parts of a system, but it trades immediate consistency for eventual consistency that you must plan for.
  - Commands vs events
  - Publish and subscribe
  - Transactional outbox pattern
  - Eventual consistency trade-offs
  - Sagas for multi-step workflows
  - Idempotent event consumers
- Message Brokers: RabbitMQ and Kafka
  Optional
  Larger systems move events through a dedicated broker, and RabbitMQ and Kafka are built for different jobs.
  - RabbitMQ exchanges, queues and bindings
  - Acks and dead-letter queues
  - Kafka topics and partitions
  - Consumer groups and offsets
  - Ordering and delivery guarantees
  - Choosing a queue vs a log
  - RabbitMQ tutorials
  - Apache Kafka documentation
- Scaling and Connection Management
  Core
  Handling more traffic mostly means running more stateless copies of your app and protecting the database behind them.
  - Stateless servers and shared state
  - Horizontal vs vertical scaling
  - Load balancing strategies
  - Database connection pooling
  - Read replicas for heavy reads
  - Multiple Node.js processes per machine
  - node-postgres: Pooling
  - PgBouncer docs
- Performance Testing and Profiling
  Recommended
  You cannot fix what you have not measured, so load test first and then profile to find the real bottleneck.
  - Latency percentiles: p50, p95, p99
  - Load tests with k6 or autocannon
  - CPU profiles and flame graphs
  - Heap snapshots for memory leaks
  - Monitoring event loop delay
  - Node.js: Profiling applications
  - Grafana k6 docs
- System Design Fundamentals
  Recommended
  System design interviews and real project planning both ask you to sketch components, estimate load and justify trade-offs.
  - Back-of-envelope capacity estimates
  - Consistency vs availability trade-offs
  - Sharding and partitioning basics
  - Designing for partial failure
  - Practice: URL shortener, feed, chat
Build: Modular Bookmarks Platform
Reorganize the API into users, bookmarks and notifications modules with controller, service and repository layers, where bookmark events reach notifications through an outbox table and a worker. Load test the list endpoint before and after your caching and pooling changes and record the p95 results in the README.
9
Shipping and Running in Production
About 3-4 weeks
Package, deploy and monitor a backend service, and know what to do when it breaks.
- Docker and Containers
  Core
  Containers are how most backends are packaged and run, so you need to build small, secure images and a local stack with Compose.
  - Images, containers and layers
  - Writing a Dockerfile for Node.js
  - Multi-stage builds for small images
  - Running as a non-root user
  - .dockerignore and build cache
  - Docker Compose for local services
  - Docker docs: Multi-stage builds
  - Docker Compose docs
- CI/CD with GitHub Actions
  Core
  Automated pipelines run your checks on every pull request and deploy the same way every time, which teams treat as the baseline.
  - Workflows, jobs and steps
  - Lint, type-check and test on PRs
  - Service containers for test databases
  - Building and pushing images
  - Deploying on merge to main
  - Environment secrets and approvals
  - GitHub Actions docs
- Structured Logging
  Core
  When something fails in the middle of the night, searchable JSON logs with request IDs are what let you find the cause quickly.
  - JSON logs with pino
  - Choosing the right log level
  - Correlation and request IDs
  - Never log secrets or tokens
  - Shipping logs to a central store
  - Pino docs
- Metrics, Tracing and OpenTelemetry
  Core
  Metrics tell you something is wrong and traces show where, and OpenTelemetry is the vendor-neutral standard most teams use to collect both.
  - Rate, errors and duration metrics
  - Traces, spans and context propagation
  - OpenTelemetry Node.js auto-instrumentation
  - Exporting to a collector
  - Dashboards and useful alerts
  - SLOs and error budgets
  - OpenTelemetry: JavaScript
  - OpenTelemetry: Signals
- Cloud and Deployment Basics
  Core
  You should be able to put a service online yourself and know which managed services your team's cloud offers.
  - VMs vs containers vs serverless
  - Managed PostgreSQL and Redis
  - Object storage for files
  - Regions, networking and firewalls
  - IAM roles with least privilege
  - Keeping an eye on costs
  - The Twelve-Factor App
- Reliability in Production
  Recommended
  Healthy services shut down cleanly, deploy without downtime and can be restored from backups, which is what on-call work relies on.
  - Liveness and readiness checks
  - Graceful shutdown on SIGTERM
  - Rolling, zero-downtime deploys
  - Tested backups and restores
  - Rollbacks and feature flags
  - Runbooks and blameless postmortems
  - Node.js docs: Signal events
  - Kubernetes docs: Probes
Build: Production Launch
Containerize the bookmarks platform and deploy it with managed PostgreSQL and Redis through a GitHub Actions pipeline, on a custom domain with HTTPS. Add JSON logs, OpenTelemetry traces, health checks and a written rollback plan, then break something on purpose and find it through the traces.

Last reviewed Sep 25, 2026.

How the Web Works and Your Toolkit

Node.js and TypeScript in Depth

Building HTTP APIs

Databases and Data Modeling

Authentication, Authorization and Security

Caching, Background Jobs and Real-Time

Testing and Code Quality

Architecture and Scaling

Shipping and Running in Production

How the Web Works and Your Toolkit

Internet and Networking Basics

HTTP in Practice

DNS, Domains and TLS

Linux Shell Basics

Git and GitHub Workflow

Node.js and TypeScript in Depth

Modern JavaScript for Servers

The Node.js Runtime and Event Loop

Modules and npm

Streams, Buffers and Files

TypeScript for Backend Code

Node.js Built-in Modules

A Second Language: Go or Python

Building HTTP APIs

Express 5 Fundamentals

Middleware and Error Handling

REST API Design

Validation with Zod

API Documentation with OpenAPI

GraphQL and gRPC

Databases and Data Modeling

SQL with PostgreSQL

Relational Data Modeling

Indexes and Query Performance

Transactions and Concurrency

ORMs, Query Builders and Migrations

MongoDB and Document Data

Redis as a Data Store

Authentication, Authorization and Security

Storing Passwords Safely

Sessions, JWTs and Refresh Tokens

OAuth 2.0 and OpenID Connect

Authorization and Access Control

OWASP Top 10 and API Risks

Rate Limiting and Abuse Protection

Secrets and Configuration

Caching, Background Jobs and Real-Time

HTTP Caching

Caching with Redis

Queues and Background Jobs

Webhooks and Idempotency

Real-time with WebSockets and SSE

Calling External Services and AI APIs

Testing and Code Quality

Unit Testing

Integration Tests with Real Dependencies

Contract and Schema Tests

Linting, Formatting and Type Checks

Debugging Node.js

Architecture and Scaling

Layered Application Structure

Modular Monoliths and Microservices

Event-driven Design

Message Brokers: RabbitMQ and Kafka

Scaling and Connection Management

Performance Testing and Profiling

System Design Fundamentals

Shipping and Running in Production

Docker and Containers

CI/CD with GitHub Actions

Structured Logging

Metrics, Tracing and OpenTelemetry

Cloud and Deployment Basics

Reliability in Production

Go deeper