Auth that covers the real world
JWT login/register/refresh, on-prem Active Directory (LDAP/LDAPS), and a long list of social providers — Google through Apple, Steam, MetaMask, and more.
NestJS 11REST + GraphQLDocker ComposeOpen Source TemplateA reference NestJS template you can clone and ship on: dual APIs, serious auth surface, Docker Compose infra, and docs that live next to the API.
Six months of hardening later — health checks, Graylog, CQRS-ready repos, and a wiki that ships with the same container as Swagger.
Live stack
nest.lacorte.dev
docs
nest.lacorte.dev
api
Swagger UI
GET /health → ok
compose
docker compose up -d --build
APIs
REST + GraphQL
Infra
Compose one-liner
Coverage gate
≥80% Jest
Capabilities
JWT login/register/refresh, on-prem Active Directory (LDAP/LDAPS), and a long list of social providers — Google through Apple, Steam, MetaMask, and more.
Versioned REST under `/api/v1` plus Apollo GraphQL on the same Fastify app, with Swagger for the HTTP surface.
Repository pattern with PostgreSQL (TypeORM) as the default users store and a MongoDB repository kept ready if you split commands and queries later.
Redis cache, Apache Kafka, and MinIO ship in Compose so queues and files are not weekend projects.
Terminus health at `/health`, structured GELF logs into Graylog/OpenSearch, MailHog for local email, and a built-in wiki next to the API.
Jest unit suite with a global ≥80% coverage threshold and a Husky pre-commit hook that refuses soft passes.
How it works
One `docker compose --env-file .env.docker up -d --build` brings up Postgres, Mongo, Redis, Kafka, MinIO, Graylog, and the API.
Hit Swagger, GraphQL, and the wiki on the same origin — no “docs over here, API somewhere else.”
`GET /health` checks Postgres, Mongo, Redis, Kafka, and heap. Compose uses it as the container HEALTHCHECK.
Try it
Implementation
Runtime
NestJS 11, TypeScript, Fastify
APIs
REST, GraphQL (Apollo), Swagger
Data
PostgreSQL, MongoDB, Redis
Platform
Kafka, MinIO, Graylog, Docker Compose
From the blog
Social login, AD group→role mapping, Argon2id, and mobile-friendly OAuth — for teams cloning a Nest boilerplate.
Read postThe kitchen-sink template introduction — what ships and why.
Read postDocker hardening, Graylog, health checks, and docs that actually ship.
Read postFAQ
The plumbing drains. Start from the live demo or the GitHub template.