Phase 07: Enterprise Spring & Data

Timeline: Months 9-11 (Weeks 33-44) Estimated Effort: 12 weeks at 10-15 hours/week (~150 hours)

Why This Phase Exists

Everything before this was foundation. Modern Java, DSA, OOP, generics, concurrency, JVM internals — all of that is the price of admission to enterprise work, not the work itself. What MNCs actually pay you to build is this: Spring Boot services that expose REST APIs, talk to databases, authenticate users, emit metrics, and survive production. If you can walk into a room and say “I understand how a Spring Boot service is wired end-to-end, from @RestController down to HikariCP connection pool sizing,” you have crossed the threshold from “Java developer” to “backend engineer companies bid for.”

This is also the phase where Zoho-style applied work stops being aspirational and starts being demonstrable. By the end, you will have deployed a real service to the internet, with real observability, that a hiring manager can curl.

What You’ll Cover

#

Topic

File

Focus

1

Spring Boot Fundamentals

01_spring_boot_fundamentals.md

DI/IoC, auto-configuration, profiles, bean lifecycle

2

REST APIs & Web Layer

02_rest_apis_and_web_layer.md

Controllers, validation, ProblemDetails (RFC 7807), OpenAPI

3

Data Access: JPA and Beyond

03_data_access_jpa_and_beyond.md

JPA/Hibernate reality, N+1, jOOQ, Flyway, HikariCP

4

Testing the Full Stack

04_testing_the_full_stack.md

JUnit 5, Testcontainers, slice tests, Pitest

5

Security the Practical Way

05_security_the_practical_way.md

Spring Security 6, JWT, OAuth2, method security

6

Observability

06_observability_metrics_logs_traces.md

Micrometer, structured logging, OpenTelemetry

7

Config & Deployment

07_config_and_deployment.md

Env vars, secrets, Docker, K8s probes, CDS/native

8

Phase Projects

projects.md

URL shortener + hardening + jOOQ migration blog

How to Work Through This Phase

  1. Weeks 1-2 (files 01-02): Get a Spring Boot 3.4+ / Java 21 project running. Build a trivial CRUD REST API for a fake domain (books, tasks — doesn’t matter). Fluency comes from repetition, not reading.

  2. Weeks 3-4 (file 03): Data. Wire Postgres via Docker. Feel the pain of N+1 firsthand — write a JPA query that triggers it, prove it in logs, fix it.

  3. Weeks 5-6 (file 04): Testing. Stop writing untested code. Testcontainers is your new best friend; if you skip it, your integration tests are lying to you.

  4. Week 7 (file 05): Security. Just enough to be dangerous — JWT-secured endpoints, method security on service methods. Do NOT rabbit-hole into custom OAuth2 flows.

  5. Week 8 (file 06): Observability. If you can’t see it, it doesn’t work. /actuator/prometheus scraped into a real Prometheus.

  6. Week 9 (file 07): Containerize and deploy. Fly.io or Render are the cheapest paths from “runs on localhost” to “has a public URL.”

  7. Weeks 10-12: Projects. The URL shortener is the anchor. Don’t skip the hardening pass — it’s the difference between a demo and a portfolio piece.

Dev Environment

You’ll need, on top of Phase 01 setup:

brew install postgresql@16 redis
brew install --cask docker            # or OrbStack, faster on macOS
brew install httpie k6 grafana/grafana/grafana  # optional but useful

# Spring Boot version pin (put in pom.xml or gradle):
# org.springframework.boot:spring-boot-starter-parent:3.4.x   (Java 21 baseline)

Use Spring Initializr (start.spring.io) to bootstrap every project. Manual pom.xml writing is a time-tax you don’t need to pay this decade.

Exit Criteria

You’re done when you can honestly answer “yes” to all of these:

  • You can bootstrap a Spring Boot 3.4+ / Java 21 service with Spring Web, Spring Data JPA, Actuator, and Micrometer from a blank directory in under 10 minutes

  • You can explain what @SpringBootApplication actually does (three annotations, auto-configuration, component scan)

  • You know why constructor injection is the only acceptable form of DI and can defend that position against a colleague who wants @Autowired on fields

  • You can write a @RestControllerAdvice that returns RFC 7807 ProblemDetail responses for validation and domain errors

  • You can catch and explain an N+1 query problem in a JPA repository, and you know at least two ways to fix it (@EntityGraph, JOIN FETCH)

  • You’ve used Testcontainers to spin up a real Postgres in an integration test — no more H2 lies

  • You have a running Spring Boot service that authenticates with JWT and enforces method-level authorization

  • You’ve written a custom Micrometer Counter and seen it appear in /actuator/prometheus

  • You have a deployed URL shortener at a public URL, with a Grafana dashboard you can screenshot

  • You can Docker-build a Spring Boot service and explain why a multi-stage build with JLink or CDS matters

What Most People Get Wrong

  • They over-annotate. Every Spring newbie discovers @Service, @Component, @Repository, @Autowired, @Qualifier, @Primary and starts sprinkling them like seasoning. Constructor injection with final fields and no @Autowired is the modern idiom. Read the file, then unlearn.

  • They test against H2 instead of the real database. H2 in “Postgres compatibility mode” lies to you constantly. Testcontainers is not optional in 2026.

  • They deploy without observability. A service without metrics and traces is a black box the moment it hits production. Wire Micrometer on day one, not “later.”

  • They skip security until it’s a fire. Add Spring Security in the initial dependency list even if endpoints are open. Retrofitting auth into a mature service is measurably worse than starting with it.

  • They confuse “works on my machine” with “works.” If it hasn’t run in a container, on a machine you don’t own, hit by traffic you didn’t generate, you don’t yet know if it works.

Return to ../README.md · Next: 01_spring_boot_fundamentals.md