Production-Grade Multi-Product AI Backend on a Shared Core

The startup was standing up two products — one retrieval-heavy, one vision-heavy — as separate FastAPI backends. Auth was duplicated, RBAC was duplicated, observability was duplicated, and the two codebases were already diverging in subtle ways. Any cross-cutting fix needed to be applied twice.

The instinct on day one was microservices. The reality was a four-person engineering team that could not afford the operational overhead of two deploys, two auth systems, and two observability stories.

We consolidated onto a modular monolith: one FastAPI app, 11 route groups, 36 endpoints, one set of migrations. RS256 JWT auth (10-minute access, 30-day refresh) with token versioning so a password change invalidates every session without growing a revocation list. 4-role RBAC enforced via FastAPI dependency injection. Prometheus metrics and OpenTelemetry spans are emitted across every route.

The key containment pattern: per-product routers and per-product ARQ workers. Shared infra, isolated blast radius. A slow vision job cannot starve the retrieval product, and a bad migration in one product’s models cannot take the other down. Deployed as Docker multi-stage images to AWS ECR (me-central-1), fronted by Traefik.