00Departure / 出発
● Train 03 · platform 7 · now boarding

Bernhard Mebert,
software engineer.

I'd rather understand the why before arguing about the how. Building things in Java, Spring Boot, and TypeScript - riding the line from engineer toward Software Architect, one project at a time.

Bernhard Mebert
passengerBERNHARD MEBERT
ENGengineer · today
ARCarchitect · ahead
roleSoftware eng.
companyDATEV eG
track07 stops
BOARDING
seat · 21A
platform · /home
·
this way →
journey
begins
depart for stop 01 →
01Journal / 日記

How I work, written longhand.

entry · nuremberg · 2026.05

Software engineer at DATEV eG, currently in a dual-study program for Computer Science. I build Spring Boot services and REST APIs professionally, and use side projects to push into React, Next.js, TypeScript - and the occasional Minecraft plugin.

The dual program means I've spent as much time in requirements sessions as in IDEs. That's changed how I work: I want to know who something is for and why it matters before I argue about how to build it. Most engineering decisions get easier once you've answered the first two questions honestly.

Side projects are where I go deeper than the day job allows - owning the architecture end-to-end, picking the tools I wouldn't pick at work, and shipping things that aren't trapped behind an internal repo.

Away from the keyboard you'll usually find me at the gym, in a game, or a few pages into a book - I like staying active and keeping something new to learn within reach.

02Featured Project / 本所
// authora · auth service · spec-first in progress

Authora - authentication, owned end-to-end.

I needed authentication for the other things I'm building, and I didn't want to wire a third-party provider into every one of them. Building it myself forced me to understand JWT rotation, OAuth2 flows, and the operational pieces - rate limiting, audit logging, admin tooling - that most tutorials skip past. It also gave me a public project that shows the kind of backend work I do at DATEV, without the IP constraints.

stack · spring boot 4 · java 21 · spring security · postgresql · openapi

REQUEST LIFECYCLE Client web · cli · sdk HTTPS Auth Service Spring Boot · Java 21 JDBC PostgreSQL Audit log append-only Rate limiter OAuth2 dispatcher Google GitHub ─── request & data flow

key decisions

  • Spec-first API design. OpenAPI YAML is the source of truth; DTOs are generated at build via openapi-generator-maven-plugin. Contract changes go through the spec, not the code.
  • JWT with refresh-token rotation and reuse detection. Short-lived access tokens, one-shot refresh tokens. If a revoked refresh token is presented, the whole token family is invalidated and a TOKEN_REUSE_DETECTED event hits the audit log.
  • OAuth2 against Google and GitHub directly - no third-party auth provider in the path.
  • Append-only audit log on a separate table. Easier to reason about, easier to forward to a SIEM later.
  • Admin API as a first-class surface, not bolted on at the first real use case.
github.com/bermeb/authora authora.bermeb.dev
03Currently Learning / 今

Next destinations on the line.

Skills I'm investing real time into right now - the stations after this one.

track destination platform status
security SEC IT Security Application security fundamentals, secure-by-design, vulnerability assessment. A·07 on time
architecture CNA Cloud-Native Architecture Containerization, distributed systems, cloud-native patterns. Aligns with my work direction at DATEV. B·12 on time
tooling AI AI-Driven Engineering LLM integration patterns, prompt engineering, AI-augmented developer workflows. C·03 on time
NEXT UPDATE · TYPED BY HAND · NO ETA GUARANTEED ●
04Postcards / 便り

Things I built along the way.

Side projects owned end-to-end - designed, shipped, maintained.

spigot
// rpgchat·java · spigot api · minecraft nms

RPGChat

Minecraft RPG servers want immersive in-character chat, but vanilla chat is global and breaks the illusion. RPGChat replaces it with floating text visible only to nearby players - proximity whispers, multi-channel support, word filtering, anti-spam.

Reaches into Minecraft's NMS layer for packet-level rendering, so it works across versions 1.8 through 1.21. Published on SpigotMC with over 65,000 downloads.

github spigot
on-device
// traqit·react · typescript · vite · indexeddb · chart.js · pwa

TraqIt

Body composition trackers all want your data on their servers. TraqIt is a privacy-first PWA that keeps everything on-device - custom fields, photo comparisons, chart-based analytics, full offline support. No account, no sync, no telemetry.

"No data ever leaves the device" isn't a marketing claim - there's no backend to leave to. IndexedDB for everything, including binary photo data.

github live
for fun
// sortviz·react · typescript · vite

SortViz

I wanted to see sorting algorithms run, including the unserious ones. SortViz visualizes the classics - BubbleSort, QuickSort, MergeSort - alongside StalinSort and other jokes. Adjustable speed and array size.

Built for fun. Sometimes that's the reason.

github live
mobile
// weeklycart·react · typescript · vite · pwa

WeeklyCart

Grocery list apps are either bloated or designed for desktop. WeeklyCart is a one-handed, mobile-first PWA for weekly shopping - recurring lists, offline by default, no account.

Designed around the actual ergonomics of holding a phone in one hand while pushing a cart with the other.

github live
05Academic Papers / 論文

Things I wrote - bound and submitted.

Research and academic work. Each one is a paper card - title, abstract, key findings, what it means in practice.

paper
// api-first·Short paper · 2025

API-First Design - advantages, disadvantages.

Why teams flip from Code-First to API-First - and where the paradigm bites back.

stack · openapi · contract-first · mock servers · cdc

abstract

Systematic literature review combined with five qualitative expert interviews. Treats the OpenAPI spec as the single source of truth and examines how that changes developer experience, scalability, and team coordination.

key findings

  • Strengthens loose coupling for microservices - contracts enforce decoupling Conway's Law usually fights against.
  • Parallel work: frontend, backend and QA build against mock servers as soon as the contract is signed.
  • Auto-generated docs stay in sync with the spec - kills documentation drift.
  • Higher upfront cost; spec-first isn't a substitute for interpersonal communication.

so what

Not a silver bullet. Strict API-First for external/partner APIs; lighter Consumer-Driven Contracts for internal teams; Code-First for prototyping with a planned "flip" once the project stabilizes.

research
// paper-tracing·Design science research · 2025

Backpressure & Distributed Tracing.

Reactive backpressure with live OpenTelemetry signal, across a 5-service mesh.

stack · spring webflux · opentelemetry · java 21 · loom · jmeter

abstract

A "Load-Score" algorithm combining latency, error rate, CPU, memory and queue depth dynamically switches between buffer / throttle / drop strategies, informed by distributed tracing in real time.

key findings

  • P95 latency: −70.57% vs. static configuration.
  • Error rate: 12.34% → 2.86% under peak load.
  • Reactive backpressure outperformed Java 21 Virtual Threads on I/O-heavy workloads.

so what

Tracing isn't just for debugging - feeding live OTel signal back into the load-shedding decision changes which strategy is correct moment-to-moment.

study
// no-code-eval·Student research project · 2026

No-Code Platforms as an Alternative to Bubble.io.

Choosing a GDPR-safe, streaming no-code stack for an AI writing app - decided by the numbers, not the hype.

stack · weweb · supabase · openai · sse streaming · ahp

abstract

Systematic market analysis of 21 no-code/low-code platforms, distilled into a weighted five-dimension criteria catalog. Weights were derived with Saaty's Analytic Hierarchy Process (AHP) and consistency-checked, then a quantitative utility analysis scored six finalists against 94 individual requirements.

key findings

  • Bubble.io ruled out: limited GDPR compliance, a documented sluggish rich-text editor, and total vendor lock-in with no code export.
  • WeWeb + Supabase scored highest - 8.39 / 10 - winning on full code export, EU hosting, and native SSE streaming.
  • A sensitivity analysis confirmed the winner is robust to changes in the criteria weights.

so what

The cheapest path to ship isn't the cheapest to live with. Once an AI writing tool has to scale and stay compliant, code export, EU hosting and streaming support matter more than drag-and-drop speed - this is the analysis that picked Authora's stack.

thesis
// bachelor's thesis·currently writing

Domain-Driven Design in Orchestrated Microservices - Introduction and Evaluation in an Existing Service

06Toolkit / 道具

What's in the suitcase.

frontend
ReactNext.jsVue.jsViteTypeScriptJavaScriptTailwind CSSHTML/CSS
backend
JavaSpring BootC#BlazorREST APIsNode.jsPostgreSQL
tools/devops
GitDockerLinuxCI/CD
practice
Agile/ScrumTestingClean CodeSystem Design
07Destination / 棟梁

Heading toward Software Architect.
Send a postcard.

"If you've read this far, you probably have a reason. Tell me what you're building, and I'll tell you whether I can help."

thanks
for the ride
emailbernhard@bermeb.dev
githubgithub.com/bermeb
linkedinlinkedin.com/in/bernhard-mebert
destination · architect bermeb · 2026

Designed with Claude Design