← Back to portfolio Portfolio Post

Building and testing a 3-tier ERP on Kubernetes with Northflank

I took a classic AWS 3-tier architecture from my cloud computing class and rebuilt it on Northflank, a platform that runs on Kubernetes. Then I load-tested it, probed its security, and deployed a full-stack user-management app on it.

GitHub Repo Live Demo ↗

The goal

Our lecture diagram showed a web tier, an app tier and a database tier, with a VPC, two availability zones, a load balancer and an office-only VPN. I wanted to see how much of that I could build for free, and where the limits are.

What I built

Three tiers in one project: a public web service, an application service and a managed PostgreSQL database that isn't exposed publicly.
Infrastructure by script: a Bash script that calls the Northflank API to create the project, database, secrets and services, and is safe to re-run.
Redundancy: 2 instances per service, behind an Envoy proxy that spreads the traffic.
Access control: an IP allowlist standing in for the diagram's VPN, plus automatic HTTPS.
The app: Next.js 14 with Auth.js, Prisma and PostgreSQL. Users register, log in, and see a dashboard listing all registered users, with update and delete for their own account.

What I measured

35 / 25

Load balancing: 60 requests split across the two pods

~270 ms

TCP connect from Colombo to London — mostly distance, not a slow server

~260 req/s

Throughput at 100 concurrent users on a very small free plan

Security audit: valid TLS 1.2/1.3 and HTTPS redirects, but missing security headers and rate limiting, which I then fixed in the app's config.

The throughput number reflects my home connection and the free plan more than the platform's ceiling, and the latency is dominated by the distance between Colombo and London.

What I learned

Platforms like this hide Kubernetes but not its behaviour: pods, replicas, services and proxies are all visible in the output.
A test tool can mislead you. ab reported thousands of "failed" requests that were really just varying response lengths.
A PaaS is fast to set up, but it can't replace a real VPC and VPN, so my design is an equivalent, not a copy.

Stack

Northflank Kubernetes Docker Next.js Auth.js Prisma PostgreSQL Bash ab wrk