backd
A config-driven REST backend over MongoDB. Declare realms, databases and collections as files on disk, and get a schema-validated, queryable document API. Add server-side functions for the logic clients can’t be trusted with: background jobs, cron schedules and webhooks included.
Open source, MIT licensed. Before exposing a realm, go through the hardening checklist.
What you get
One stateless Go service and a MongoDB database. No handlers to write per collection.
Configuration as files
A directory per realm, database and collection. Each collection is a JSON Schema, with optional indexes.json. Invalid config stops startup and names the file.
Schema-validated writes
JSON Schema draft 2020-12 enforced on every write, with field-level errors. The same schema is mirrored as a MongoDB $jsonSchema validator.
Queries without injection
Filter with where, sort with order_by, paginate and count. Every field and value is checked against the schema. Client input never reaches MongoDB raw.
Optimistic concurrency
_meta.version, ETag and If-Match. Every write is conditional, so concurrent updates are never silently lost.
Automatic provisioning
Collections, validators and indexes are created at startup, or verified for least-privilege deployments. Nothing is ever dropped.
Users and single sign-on
Built-in users per realm with argon2id passwords, sessions valid across the realm’s databases, API keys for services, invitations and brute-force protection. Email verification, password reset and address changes through any email provider you call from a function, and erasure of a user’s data on request.
Access rules
The rules of each collection decide who may read, create, update and delete each document. Read rules run inside the database query, so lists and counts only show what callers may see.
Server-side functions
JavaScript or TypeScript next to your collections, run in isolated Deno processes: sync calls, background jobs you can follow, cron schedules, webhooks. Rules, secrets, rate limits, idempotency, a network allowlist and full call history are built in. Start here.
Built for operations
JSON logs with request IDs, health and readiness probes, Prometheus metrics with Grafana dashboards, request limits, timeouts and graceful shutdown.