Appearance
Backend Services
Microtec ERP backend is composed of 13 services deployed on Azure Container Apps (ACA). All services are built on .NET 8 following Clean Architecture with CQRS. One service (Keycloak) runs on Java.
Service Roster
| # | Service | CAE Placement | CPU / RAM | Purpose |
|---|---|---|---|---|
| 1 | Gateway.API | Public CAE | 0.25 CPU / 0.5 Gi | YARP reverse proxy — routes 10 downstream clusters, internet-facing entry point |
| 2 | AppsPortal.Apis | Private CAE | 0.5 CPU / 1 Gi | Core ERP module — accounting, sales, finance, purchase; CQRS-based business logic |
| 3 | Inventory.Apis | Private CAE | 0.5 CPU / 1 Gi | Stock and warehouse management |
| 4 | BusinessOwners.Apis | Private CAE | 0.5 CPU / 1 Gi | Multi-tenant management — tenant provisioning, subscriptions, licensing |
| 5 | BusinessOwners.AdminPortal | Private CAE | 0.5 CPU / 1 Gi | Blazor admin portal — includes Hangfire scheduler and DB backup jobs |
| 6 | Hr.Personnel.Apis | Private CAE | 0.5 CPU / 1 Gi | Human resources — external repo MicrotecHR / Microtec.Hr.Personnel.sln |
| 7 | Integration.Apis | Private CAE | 0.25 CPU / 0.5 Gi | ZATCA Saudi e-invoicing compliance |
| 8 | Attachment.Apis | Private CAE | 0.25 CPU / 0.5 Gi | Azure Blob / File Storage management |
| 9 | Notification.Apis | Private CAE | 0.25 CPU / 0.5 Gi | Email, SMS and push notifications |
| 10 | Workflows.Apis | Private CAE | 0.5 CPU / 1 Gi | Business workflow engine — external repo WorkflowDesigner |
| 11 | Keycloak | Public CAE | 1 CPU / 2 Gi | SSO identity provider (Java, not .NET) |
| 12 | Template.Blazor | Private CAE | 0.25 CPU / 0.5 Gi | Reporting templates — uses Microtec.Reporting NuGet |
| 13 | Platforms.Worker | Private CAE | 0.25 CPU / 0.5 Gi | Background jobs (Hangfire) |
CAE Placement Summary
Public CAE services
These services are exposed to the internet via Azure Container App Environment ingress:
- Gateway.API — the primary entry point for all ERP and BO tenant traffic.
- Keycloak — SSO login pages and token endpoints must be reachable by browsers.
Private CAE services
All other services run inside the VNet and are reachable only from within the Container Apps environment via internal DNS (*.internal.<env>.azurecontainerapps.io). mTLS is enabled between services.
Source Code Locations
| Service | Repository / Path |
|---|---|
| Gateway.API | Platforms/Src/Gateway/Gateway.Yarp/ |
| AppsPortal.Apis | Platforms/Src/AppsPortal/Accounting/AppsPortal.Apis/ |
| Inventory.Apis | Platforms/Src/AppsPortal/Inventory/Inventory.Apis/ |
| BusinessOwners.Apis | Platforms/Src/BusinessOwners/BusinessOwners.Apis/ |
| BusinessOwners.AdminPortal | Platforms/Src/BusinessOwners/BsuinessOwners.AdminPortal/ |
| Hr.Personnel.Apis | External repo: MicrotecHR/ — see HR Service |
| Integration.Apis | Platforms/Src/InfrastructureServices/Integration/Integration.Apis/ |
| Attachment.Apis | Platforms/Src/InfrastructureServices/Attachment/Attachment.Apis/ |
| Notification.Apis | Platforms/Src/InfrastructureServices/Notification/Notification.Apis/ |
| Workflows.Apis | External repo: WorkflowDesigner/ |
| Keycloak | External repo: KeycloakProviders/ (custom Java extensions) |
| Template.Blazor | Platforms/Src/InfrastructureServices/Reporting/ |
| Platforms.Worker | Platforms/Src/ (Hangfire host) |
Shared NuGet Packages
All .NET services consume shared infrastructure from a private Azure DevOps NuGet feed:
| Package | Purpose |
|---|---|
Microtec.Domain | Core interfaces, base classes, DTOs |
Microtec.Persistence | EF Core, repositories, caching |
Microtec.Web.Core | Auth, middleware, filters |
Microtec.Web.Hosting | Hosting extensions and startup helpers |
Microtec.Contracts | Shared cross-service contracts |
Microtec.Messaging | Azure Service Bus messaging |
Microtec.Reporting | Report generation (used by Template.Blazor) |
Microtec.Zatca.Integration | Saudi e-invoicing (used by Integration.Apis) |
Microtec.Keycloak | Keycloak identity provider integration |
NuGet Authentication
A PAT is required to restore packages. See Platforms/Solution Items/NUGET-SETUP.md for setup instructions. Dockerfiles use --mount=type=secret,id=nuget_pat; pipelines use $(System.AccessToken).
Related Documentation
- HR Service — Dedicated HR service deep-dive
- HR API Reference — Exception codes and API reference
- Coding Conventions — .NET style guide
- CQRS Patterns — Command/query implementation guide
- Gateway API — Routing and proxy configuration
- Integration / ZATCA — Saudi e-invoicing compliance