Iris is a portfolio project that demonstrates industrial-grade platform engineering on a concrete customer-management backend. The goal is not to build the smallest possible demo — it is to show what running a real system looks like, end-to-end:
- The code: a Spring Boot 4 / Java 25 REST backend with Kafka messaging, PostgreSQL, Redis, an LLM bio generator (Ollama), and an Angular 21 zoneless UI.
- The runtime: GKE Autopilot in ephemeral mode (cluster exists only during demos, ~€2/month), full LGTM observability stack, Workload Identity Federation, External Secrets from Google Secret Manager.
- The CI/CD: GitLab pipeline with Testcontainers, SBOM, cosign signing, Sonar, Semgrep, Trivy/Grype, PIT mutation tests, kind-in- CI manifest validation.
- The industrial tooling: Renovate, release-please, lefthook, Conventional Commits, Argo CD GitOps, Argo Rollouts canary, Kyverno policies, cert-manager, Chaos Mesh, Unleash feature flags.
Every moving part is documented in an ADR
(35+ decisions under docs/adr/)
so the "why" survives the next maintainer.
GitLab is the source of truth. The repos on this GitHub organization are read-only mirrors maintained by a CI job on GitLab. Issues and PRs opened here will not be reviewed.
Contribute on GitLab: gitlab.com/iris-7
The split is deliberate: GitLab hosts the full CI, Container
Registry, release automation and merge-request workflow. GitHub
exists for visibility + narrow security checks (CodeQL native SAST,
OSSF Scorecard). Full rationale in the service repo's
docs/ops/ci-philosophy.md.
| Repo | Stack | Purpose |
|---|---|---|
| iris-service-java | Spring Boot 4 · Java 25 · Kafka · PostgreSQL · Redis | Backend REST API, business logic, observability emission. |
| iris-ui | Angular 21 zoneless · TypeScript · OpenTelemetry Web SDK · raw SVG | Front-row seat — health probes, traces, logs, pipeline status, chaos triggers. |
| iris-service-python | FastAPI · Pydantic v2 · SQLAlchemy 2 async · Kafka · Redis | Python sibling of the backend — same contracts, mypy strict, 90%+ coverage gate. |
| iris-service-shared | Terraform · Kubernetes · OpenTelemetry collector · Grafana | Cross-cutting backend infrastructure — clusters, dashboards, deploy stacks. |
| iris-common | Shell · CI templates · Renovate base | Universal conventions — release engineering, Conventional Commits CI, ADR tooling. |
Paired release cadence: both ship together on v1.x tags produced
by release-please on GitLab.
- ADR-driven design — every non-obvious choice has a written justification and revisit conditions.
- Cost discipline — GCP billing alert at €10/month with an
automatic cluster kill-switch (Cloud Function on Pub/Sub). See
cost-control.md. - Portable CI — a
Jenkinsfiledemonstrates the industrial tooling runs under Jenkins for enterprises locked out of GitLab SaaS. - AI-assisted integration — the docs, ADRs, CI hardening and K8s baseline were authored with an LLM pair. The repo is explicit about which parts were AI-accelerated and which were human-decided.
- Start at the service README.
- Read ADR-0022 (ephemeral cluster) and ADR-0030 (why GCP) for the top-level trade-offs.
- Browse
docs/ops/runbooks/to see how operational incidents are handled. docs/reference/cost-model.mdfor the explicit €/month per component.
Iris — Spanish for watchtower — stands over a real running system and answers: "what's the code doing right now?"