ONLINE 2025 PRIVATE Company · Team 5

Core CMS — MongoREST Engine

Headless CMS core: declare an entity + grant permissions and instantly get a dynamic REST API (filtering + relations), with zero controllers to write

FastifyTypeScriptMongoDBMongoRESTRedisBullMQMinIOSwagger/OpenAPIPrometheusLokiGrafana

Enterprises using it

Controllers to write

Architecture layers

Team members

Overview

A headless CMS core: instead of writing a controller per API, you just declare an entity and grant permissions — the system auto-generates a dynamic REST API with filtering and relations on the fly, with automatic Swagger/OpenAPI docs. Inspired by PostgREST but built for MongoDB, I created 'MongoREST' — a layer that translates granted permissions into dynamic queries (filters + relations follow exactly the caller's access). A three-layer architecture: common (shared API layer) → intermediate (MongoREST query generation) → MongoDB. Schemas are managed in the backend with MongoDB native and validated with AJV, and the whole system extends through a WordPress-inspired plugin system. A background image pipeline (BullMQ + Sharp) auto-generates multiple sized variants from a single source image. It runs on Fastify (high performance), Redis (cache), MinIO (file storage), monitored with Prometheus + Loki + Grafana. It currently powers production systems for VPBank, ACB, Dinh Group, MangoAds satellites, Inoue, Kewpie...

Role: Core + plugin-system developer (the heart of the system) — in a 5-person team

System architecture

> Common (API layer)

REST endpoints

Swagger/OpenAPI

Auth & Permissions

JWT + Passport

Plugin hooks

> Intermediate (MongoREST)

Query builder

filter + relation

Permission resolver

AJV

validation

> MongoDB

Collections

Schema (native)

> Worker & Infra

BullMQ

Image pipeline

Sharp

Fastify

Redis

cache

MinIO

storage

> Observability

Prometheus

Pino

Loki

Grafana

Modules & Services

Entity & API

Entity declarationAuto REST APISwagger/OpenAPIDynamic filterDynamic relation

MongoREST

Query builderPermission resolverPostgREST-styleAggregation

Permissions & Validation

Grant per entityRLS-likeRelation scopingAJV / JSON Schema

Plugin System

WordPress-styleHooksExtend without core change

Worker & Images

BullMQ jobsSharp resizeMulti-size variantsnode-cron

Infra & Observability

FastifyRedisMinIOPrometheusLokiGrafana

Key features

Declare an entity + grant permissions to get a REST API instantly — no per-route controllers

MongoREST: dynamic filtering + dynamic relations, auto-generated from granted permissions (PostgREST-inspired)

Three-layer architecture: common → intermediate (MongoREST query) → MongoDB

WordPress-inspired plugin system — add features without touching the core

Schema managed in the backend with MongoDB native, data validated with AJV (JSON Schema)

Automatic API docs via Swagger/OpenAPI; JWT + Passport auth, bcrypt

Background image pipeline (BullMQ + Sharp): generate multiple sized variants from one source image

Fine-grained permissions: relations and returned data follow the caller's granted access

Production infra: high-performance Fastify, Redis cache, MinIO file storage

Full observability: Prometheus metrics, Pino logs → Loki + Grafana

Highlights

Running in production for VPBank, ACB, Dinh Group, MangoAds satellites, Inoue, Kewpie...

Auto-generates APIs from entity + permissions — drastically cuts backend build time

MongoREST: brings the PostgREST experience to the MongoDB world

WordPress-style plugins enable near-limitless extension without modifying the core

I own the soul of the system: the core engine + plugin system