Overview
Kiddoo is an academic DevOps platform built around a REST API for childcare-service matching. The work goes beyond the Rust application itself: it covers its delivery lifecycle, supporting cloud foundation, and operational monitoring.
The goal was to make every stage reproducible and traceable: test code, produce versioned container images, promote a version across environments, deploy the desired state through GitOps, and observe services after deployment.
Problem and goals
Manual deployments create environment drift, untracked actions, and regression risk. The project addresses four practical goals:
- Reliability: detect defects before merge and release.
- Reproducibility: describe infrastructure, containers, and deployments in version-controlled files.
- Security: restrict network flows, isolate data, keep secrets out of source code, and reduce SSH administration.
- Operability: provide probes, metrics, logs, and alerts to diagnose incidents.
Technical architecture
The application is a Rust workspace containing a persistence library and three services: api-gateway, identity-proxy, and orchestrator. PostgreSQL provides persistence and the gateway is the entry point.
Developer
│ push / pull request
▼
GitHub Actions ──► Rust tests + formatting + Clippy + test PostgreSQL
│ validated version
▼
GitHub Container Registry ──► versioned images
│ deployment repository update
▼
Argo CD ──► Kubernetes (Kustomize base + environment overlays)
│ │
│ ├── api-gateway
│ ├── identity-proxy
│ ├── orchestrator
│ └── PostgreSQL / RDS by environment
▼
Prometheus + Grafana ◄── metrics, probes, and alerts
Alongside the application platform, the AWS foundation is described with Terraform: VPC and subnets, EC2, security groups, encrypted EBS, and private RDS PostgreSQL. Ansible automates post-provisioning configuration. AWS Secrets Manager, Ansible Vault, Systems Manager, and Cloudflare Tunnel complete the security and operations model.
Key work delivered
- GitHub Actions pipeline running
cargo test --workspace,cargo fmt,cargo clippy, and a build validation with a test PostgreSQL service. - Docker-based containerization of Rust services and local orchestration through Docker Compose: internal networking, environment variables, and storage separated from application containers.
- GitOps flow: publish images to GHCR, factor Kubernetes deployments with Kustomize, then synchronize with Argo CD.
- Development, staging, and production separation so validated versions are promoted progressively.
- Modular AWS infrastructure with Terraform, automated Ansible configuration, and remote Terraform state in S3.
- Operations-focused observability: Kubernetes probes, Prometheus collection, Grafana dashboards, and alerts for availability, errors, latency, resources, and restarts.
Security and resilience
The design follows a least-exposure approach: RDS is private, security groups restrict flows to what is required, and EBS/RDS volumes are encrypted. Secrets are kept separate from repositories and images through AWS Secrets Manager, Ansible Vault, and deployment-time injection. Application access can use Cloudflare Tunnel to avoid directly opening the service port.
Controls continue after deployment: probes check service availability while metrics and logs help confirm behaviour after updates and prepare a rollback to a known stable version during an incident.
Results and lessons learned
Completed independently as a supervised professional simulation, this project provided hands-on practice with an end-to-end DevOps delivery path: Infrastructure as Code, CI, containers, GitOps, and monitoring. The main lesson is that reliable deployment is a process: an identifiable version, checks before and after delivery, and an infrastructure state that is readable in Git.
Read the full technical retrospective for architecture decisions, delivery flows, and trade-offs.
Project status
Academic project / professional simulation — completed as part of a 2026 training programme under educational supervision.