$ Spring Boot Monolith Boilerplate

Hexagonal architecture backend boilerplate with JWT, TOTP 2FA, and Meilisearch. Private repository.

→Built a Spring Boot 3 / Java 21 monolith following strict hexagonal architecture (ports & adapters) application layer never imports infrastructure, enforced through package boundaries (domain, application, infrastructure, presentation) and dependency inversion on every output port.
→Implemented JWT authentication with refresh token rotation and family based reuse detection: refresh tokens are hashed with SHA256 in the database, and reusing an invalidated token immediately terminates the entire token family.
→Added TOTP based two factor authentication with AES256GCM encrypted secrets, Base32 encoding, and Redis backed replay protection. Login is a two phase flow a short lived TOTP_PENDING token is issued first, then exchanged for a full session after code verification; that intermediate token travels over an httpOnly cookie rather than the JSON response body, closing off an XSS-exposable surface.
→Designed a JWT key versioning system using a kid header claim, allowing graceful secret rotation without logging out active users old keys remain valid for verification until their token TTL expires.
→Built a singleton root-admin governance model: the root privilege is protected at the database level with a partial unique index, a numeric role hierarchy (USER < MODERATOR < ADMIN < SUPER_ADMIN < ROOT) governs who can grant or revoke which roles, and transferring root to another user is a self-expiring workflow requiring dual TOTP confirmation from both parties (initiate → target confirms → initiator confirms → atomic role swap). The root account is barred from disabling its own TOTP, guaranteeing 2FA continuity until a transfer completes.
→Integrated Meilisearch as a search index with a Postgres first, eventually consistent Smart* fallback pattern (same approach used for Redis backed token blacklisting), plus a reconciliation cron that diffs Postgres against Meilisearch every 30 minutes and a checkpoint table for delta sync.
→Added Google OAuth login with PKCE, Resilience4j rate limiting and circuit breakers on all authentication endpoints, and a generic file upload module backed by Cloudflare R2 or local storage.
→Account deletion is handled through an outbox pattern a UserDeletedEvent is written transactionally before commit and processed asynchronously, keeping deletion side effects consistent even under failure.
→Set up a two way isolated SSH CI/CD pipeline: GitHub Actions triggers deploy via a command restricted, passphrase less key that can only run the deploy script, while the server pulls the private repo through a separate read only deploy key neither key can be used for anything beyond its single purpose.

JavaSpring BootHexagonal ArchitectureJWTTOTPMeilisearchRedisPostgreSQLResilience4jDockerCI/CD