System Architecture

A deep dive into the microservices architecture powering institutional-grade exchanges

ENVOY API GATEWAY TLS · Routing · Rate Limiting

JANUS Auth · KYC · RBAC

APOLLO Trading Engine

POSEIDON Wallets · Whitelist

ARGOS Chain · Deposits

ECHO WebSocket Feed

APACHE KAFKA EVENT BUS Event-Driven Messaging

HERMES Notifications

ADMIN Admin BFF

PLUTUS Treasury · Fees

FEE-SERVICE Tiers · Pairs

SENTINEL Admin UI

AGORA Exchange UI

Microservices Breakdown

Envoy Edge Gateway

API gateway for TLS termination, request routing, and rate limiting — the single edge entry to exchange APIs.

Envoy Proxy · TLS · HTTP/2

Janus God of Doorways

Authentication gateway handling JWT tokens (RS256), user sessions, KYC workflows, role-based access control (Casbin), 2FA, and comprehensive user management.

Go · PostgreSQL (janus_db) · Redis · Casbin

Apollo God of Order

High-frequency trading engine with order matching for limit, market, and stop orders. Balance ledgers, fee application, candles via InfluxDB, and real-time order books.

Go · PostgreSQL (apollo_db) · Kafka · InfluxDB

Poseidon God of the Sea

HD wallet generation and multi-chain address management. Private key storage via HashiCorp Vault, balance tracking, withdrawal approvals, and destination whitelist secured by 2FA then email OTP (via Hermes).

Go · PostgreSQL (poseidon_db) · Vault · Hermes

Argos All-Seeing Giant

Blockchain monitoring for deposits and withdrawals across EVM, UTXO, and Solana networks — sweeps, mempool watching, and on-chain ops.

Go · PostgreSQL (argos_db) · Kafka · gRPC

Hermes Messenger God

Multi-channel notifications. Email OTP for whitelist verification, templates, delivery tracking, Kafka consumers. SMTP in production; MailHog for UAT.

Go · PostgreSQL (hermes_db) · Kafka · SMTP

Echo Nymph of Sound

Real-time WebSocket feeds delivering order book updates, trade streams, ticker data, user balance changes, and admin system events.

Go · Kafka · WebSocket · Stateless

Themis Titan of Justice

Compliance and KYC archival — identity verification workflows, retention policies, and regulatory reporting hooks.

Go · PostgreSQL (themis_db)

Vault Manager Guardian of Secrets

HashiCorp Vault integration for cryptographic key generation, automatic key rotation, encryption services, and AppRole authentication.

Go · Vault · gRPC

Sentinel The Watchman

Operator admin panel: users, markets, fees, deposits/withdrawals, withdrawal whitelist revoke, custody, treasury, and system health — Casbin RBAC throughout.

Vue 3 · Vite · TanStack Query · REST

Audit-Log The Recorder

Immutable audit logging with cryptographic hash chain verification. gRPC interface for tamper-proof recording of all critical system operations.

Go · PostgreSQL (audit_log) · gRPC · SHA-256

Fiat-Rates The Converter

Real-time fiat/crypto exchange rate aggregation from multiple sources (CoinGecko, CryptoCompare). Multi-source validation and caching.

Go · PostgreSQL (fiat_rates) · Redis · REST

Agora The Marketplace

User-facing exchange UI: trading, wallets, deposits/withdrawals, 2FA setup, and multi-step whitelist verification.

Next.js · React · WebSocket · REST

Admin BFF The Proxy

Admin API gateway that authenticates operators and proxies Poseidon, Apollo, Argos, Hermes, and fee-service under `/api/v1/admin/*`.

Go · JWT · Circuit breakers

Plutus God of Wealth

Treasury and revenue visibility — fee collection stats, platform balances, and financial summaries for operators.

Go · PostgreSQL · REST

Fee Service The Ledger of Rates

Maker/taker fee tiers, pair overrides, and user tier assignments used by Apollo during matching and settlement.

Go · PostgreSQL · REST

Analytics The Observer

Platform analytics and reporting pipelines that feed operational dashboards and trading insights.

Go · PostgreSQL · InfluxDB

Key Architectural Principles

Database Per Service

Each microservice owns its database, ensuring data isolation, independent scaling, and technology flexibility. No shared databases, no tight coupling.

Event-Driven Architecture

Apache Kafka enables asynchronous communication between services. Events are published once and consumed by multiple services, ensuring loose coupling and scalability.

Zero-Trust Security

Every service-to-service call is authenticated using HMAC-SHA256. No implicit trust. JWT tokens for user authentication with RS256 signing.

Observability First

Prometheus metrics, Grafana dashboards, Jaeger distributed tracing, and structured logging with correlation IDs across all services.

API Gateway Pattern

Envoy handles TLS termination, rate limiting, and request routing. Single edge entry point for exchange API traffic.

Immutable Infrastructure

Docker containers, versioned database migrations (Goose), infrastructure as code. No manual server configuration.