MIME-Version: 1.0
References: <4237964E-B88B-4F6B-AD3D-FD67C17ED480@relevantlogic.com>
In-Reply-To: <4237964E-B88B-4F6B-AD3D-FD67C17ED480@relevantlogic.com>
From: Merlin Moncure <mmoncure@gmail.com>
Date: Fri, 1 May 2026 14:27:30 -0600
Message-ID: <CAHyXU0yNBHF=yJG8-XAasedUagG=+PODje_RXZVuefWqhfuvdQ@mail.gmail.com>
Subject: Re: Describing the natural architecture for an internet-facing
 Postgres based app: feedback sought
To: "guyren@relevantlogic.com" <guyren@gmail.com>
Cc: PostgreSQL General <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000ae16ea0650c76944"
Archived-At: <https://www.postgresql.org/message-id/CAHyXU0yNBHF%3DyJG8-XAasedUagG%3D%2BPODje_RXZVuefWqhfuvdQ%40mail.gmail.com>
Precedence: bulk

--000000000000ae16ea0650c76944
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Apr 27, 2026 at 9:25=E2=80=AFPM guyren@relevantlogic.com <guyren@gm=
ail.com>
wrote:

> Coming from a Rails/PHP/etc world. All of those communities generally hol=
d
> that the database should be treated as a dumb data bucket with all the
> logic in the middleware.
>
> I=E2=80=99ve long thought someone should write up what the alternative
> architecture using Postgres to its fullest would look like. In order to
> differentiate it, I start from the security advantages and work forward.
>
> I=E2=80=99d love to get some feedback on it. Harsh criticism is most usef=
ul=E2=80=A6 :-)
>
> lydb.xyz/zero-authority-architecture
>

 I have been developing in this style for many years.  Application requests
in JSON/JSONB, and zero IQ middleware outside of caching, transport
authorization, etc.  Prior to JSON, I was doing it with composite types --
postgres has been able to do some variant of this since mid 8.x series.  I
can assure you, this style of architecture works, your core assumptions are
mostly correct, although I'd gently suggest taking a broader view on
application architecture vs authorization.  Generally speaking, it is a
very fast way to write robust applications quickly, and I've written highly
scalable enterprise applications in this style.

I'm not afraid to take things to the extreme.  If you want to see examples
backend rich coding in action, take a look at pgasync
<https://github.com/merlinm/pgasync> and especially pgflow
<https://github.com/merlinm/pgflow>, which is a airflow style orchestrator
written in a stored procedure daemon :-).

merlin

--000000000000ae16ea0650c76944
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Mon, Apr 27, 2026 at 9:25=E2=80=AFPM <=
a href=3D"mailto:guyren@relevantlogic.com">guyren@relevantlogic.com</a> &lt=
;<a href=3D"mailto:guyren@gmail.com">guyren@gmail.com</a>&gt; wrote:</div><=
div class=3D"gmail_quote gmail_quote_container"><blockquote class=3D"gmail_=
quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,=
204);padding-left:1ex"><div><span style=3D"font-size:19px">Coming from a Ra=
ils/PHP/etc world. All of those communities generally hold that the databas=
e should be treated as a dumb data bucket with all the logic in the middlew=
are.<br><br>I=E2=80=99ve long thought someone should write up what the alte=
rnative architecture using Postgres to its fullest would look like. In orde=
r to differentiate it, I start from the security advantages and work forwar=
d.<br><br>I=E2=80=99d love to get some feedback on it. Harsh criticism is m=
ost useful=E2=80=A6 :-)<br><br><a href=3D"https://lydb.xyz/zero-authority-a=
rchitecture/" target=3D"_blank"><font color=3D"#157EFB">lydb.xyz/zero-autho=
rity-architecture</font></a></span></div></blockquote><div><br></div><div>=
=C2=A0I have been developing in this style for many years.=C2=A0 Applicatio=
n requests in JSON/JSONB, and zero IQ middleware outside of caching, transp=
ort authorization, etc.=C2=A0 Prior to JSON, I was doing it with composite =
types -- postgres has been able to do some variant of this since mid 8.x se=
ries.=C2=A0 I can assure you, this style of architecture works, your core a=
ssumptions are mostly correct, although I&#39;d gently suggest taking a bro=
ader view on application architecture vs authorization.=C2=A0 Generally spe=
aking, it is a very fast way to write robust applications quickly, and I=
9;ve written highly scalable enterprise applications in this style.</div><d=
iv><br></div><div>I&#39;m not afraid to take things to the extreme.=C2=A0 I=
f you want to see examples backend rich coding in action, take a look at=C2=
=A0<a href=3D"https://github.com/merlinm/pgasync">pgasync</a>=C2=A0and espe=
cially=C2=A0<a href=3D"https://github.com/merlinm/pgflow">pgflow</a>, which=
 is a airflow style orchestrator written in a stored procedure daemon :-).<=
/div><div><br></div><div>merlin</div><div><br></div><div><br></div><div><br=
></div><div><br></div><div>=C2=A0</div></div></div>

--000000000000ae16ea0650c76944--