Proprietary product · multi-repository engineering
Oriqoproduct, execution and infrastructure as one system.
A proprietary software product in development with a public frontend, authoritative backend, isolated tool runtime and coordinated deployment infrastructure.
Oriqo is proprietary IP. This case study exposes architecture and engineering boundaries without publishing product access, private repositories, operational endpoints or secrets.
Product scope
A public product surface backed by separate authoritative and execution planes
Oriqo has evolved beyond a single web application. The current deployment architecture coordinates a public Nuxt frontend, an authoritative FastAPI backend, an isolated tool runtime and a dedicated infrastructure repository with explicit ownership boundaries.
Public product surface
The Nuxt frontend owns SSR/SEO, browser authentication, Account Center, Resource Graph, tool delivery and the Integrated Admin Center while consuming browser-safe backend contracts.
Authoritative backend
FastAPI owns accounts, authentication, entitlement, Tool Platform metadata, Resource Graph control-plane data, PostgreSQL/Alembic state, Redis and rate limiting.
Private execution plane
Tool execution is isolated behind an internal HTTP contract with allow-listed runners, versioned manifests and a non-root OCI image rather than being executed inside the public frontend.
Architecture
Clear boundaries from browser request to private execution
The browser talks to same-origin frontend routes. The frontend proxies browser-safe requests to the backend; the backend remains authoritative for product state and dispatches only private tool executions to the internal runtime. Infrastructure connects these layers without exposing internal services directly.
01
Public frontend
Nuxt 4 · Vue · TypeScript · SSR/SEO · browser auth
02
Authoritative backend
FastAPI · auth/account/entitlement · Resource Graph · Tool Platform
03
Tool runtime
Private HTTP/JSON · allow-listed runners · immutable manifests
04
Infrastructure
Nginx · Compose · private network · immutable image digests
Security and delivery
Operational constraints are part of the product architecture
The delivery model intentionally separates build, deployment and runtime authority. Application repositories publish artifacts; infrastructure decides which immutable artifacts run in the integration environment; production remains an explicit decision rather than an automatic consequence of a merge.
Internal services stay internal
Backend, PostgreSQL, Redis and tool runtime are not published as host ports in the deployed topology; Nginx is the external gateway.
Immutable artifact flow
Backend and tool-runtime repositories publish non-root OCI images to GHCR. Infrastructure consumes pinned digests rather than floating latest tags.
Secrets remain host-side
Runtime credentials and internal tokens are excluded from repositories and are not part of the public case-study surface.
Rollback is designed, not improvised
Infrastructure owns smoke checks, image rollback and backup/restore contracts while database downgrade remains a separate controlled concern.
Engineering governance
Multi-repository work without hidden cross-repository side effects
Oriqo uses repository-scoped issues, branches, pull requests and validation gates even while operating in a single-developer development mode. GitHub is the source of truth and production is never implied by integration work.
Work follows an explicit work-branch → integration → production progression.
A work item authorizes one target repository and one verifiable output; cross-repository needs return to governance instead of expanding silently.
Frontend, backend, tool runtime and infrastructure retain separate technical ownership contracts.
The former standalone Admin App is retired from the active product topology; current administration capabilities are integrated into the web product surface.
Work covered
Product responsibility across software, data, security and delivery
The case study reflects product definition, architecture and implementation across the public frontend, backend contracts, data layer, authentication, runtime isolation, infrastructure and controlled release workflow.
Responsibilities
Areas of work
Technology
A stack selected for explicit product boundaries
Technologies are grouped by responsibility: browser product, authoritative API/data, isolated execution and infrastructure delivery. The architecture is intentionally more important than any single framework.
Current state
The integration environment is active; production remains separate
The current repositories document live integration work across the frontend, backend, tool runtime and infrastructure. Oriqo is still proprietary and under active development, so this page does not imply public product availability, production rollout or access to private operational surfaces.