Configuration & Testing

What belongs in code versus runtime configuration, why secrets are a separate problem, and a test strategy chosen by what each layer can actually prove.

Configuration: Separating Code From Environment

The same artifact must run in dev, staging and production — so everything that differs between them is input, not source.

Q · What belongs in the code, what belongs in runtime configuration, and how does a value actually reach the process?
Secrets Are Not Configuration

Credentials need a different storage, a different access path and a lifecycle — and rotation is the part every team skips.

Q · Where do database passwords, API keys and signing keys actually live, and how do they change?
Validate at Startup, Fail Loudly

Check everything the process needs at boot and refuse to start — rather than discovering the missing value at 3am on the first request that needs it.

Q · What should a process verify before it declares itself ready, and what should it do when a check fails?
Feature Flags: Rollout, Kill Switches and Debt

Separating deploy from release, buying an instant off-switch — and accumulating a combinatorial mess if nobody removes them.

Q · When is a runtime toggle the right tool, and what does having one cost after the launch is over?
A Test Strategy Chosen by What Each Layer Can Prove

Business logic to unit tests, database behaviour to integration tests, contracts to contract tests, and only the critical flows to end-to-end.

Q · Which kind of test should cover which part of a backend, and what does each kind actually prove?
Test Against the Real Database

A substitute engine with different SQL semantics gives you a green suite and a broken production — the failure the substitute exists to prevent.

Q · When does it matter that a test runs against the same database engine as production?
Contract Tests Between Services

Verify that a producer and its consumers still agree on the wire format, without running both systems at once.

Q · How do I know a change to my API will not break a service I do not control and cannot run?
Performance Testing a Backend

Latency, throughput, concurrency, CPU, memory, database load and dependency load are seven different dimensions — a single "requests per second" number answers almost none of them.

Q · How do I find out how this service behaves under load before production finds out for me?