Project structure · Backend
Ruby on Rails project structure
Opens with creditsA Rails 8.1 app for a tuition centre (courses, enrollments, payments), laid out exactly as rails new creates it: Hotwire and import maps for the frontend, Solid Queue, Cache and Cable on the database, and Kamal deploying a Docker image to your own server. For students who have done the Getting Started guide and want to know where authentication, jobs, admin pages, tests and deploy files go as the app grows.
Curated by Tauseef FayyazIntermediate206 files and foldersRuby 4.0 (3.4 also supported), Rails 8.1, Solid Queue 1.7Checked October 2026How it grows
Each stage opens the explorer there
- 1Day 1What the scaffold and your first hour give you124 files and folders
- 2GrowingWhat a real app with features and tests adds+51 files and folders
- ProductionWhat running it for real users adds+19 files and foldersOpens with credits
- ExpertWhat a team needs to keep it healthy for years+12 files and foldersOpens with credits
How it is organised
- Convention over configuration: put each file where Rails expects it and name it the way Rails expects, and routing, autoloading, views and tests connect themselves.
- Use the generators (`bin/rails generate`). They create the file, its test and its migration with the right names, which is how the app stays consistent.
- Business rules live in models (and plain Ruby objects under app/models); controllers stay thin and RESTful, with the seven standard actions.
- Hotwire first: server-rendered HTML with Turbo and small Stimulus controllers. Add a JavaScript bundler only when a page truly needs it.
- The database does more work in Rails 8: Solid Queue, Solid Cache and Solid Cable replace Redis for most apps, so there are fewer services to run.
- Secrets live in encrypted credentials, never in code; only the master key is kept outside Git.
- Every check runs the same way locally and in CI: `bin/ci` reads config/ci.rb, and the generated GitHub workflow runs the same scanners and tests.
- Kamal deploys the generated Dockerfile to plain servers with zero downtime; config/deploy.yml and .kamal/secrets describe production completely.
At the top of the project
Open one in the explorer for the full story
- tuition/
- .git/Git history, created by `rails new`.
- .github/GitHub settings: the CI workflow and Dependabot config that `rails new` writes for you.2 inside
- .kamal/Kamal secrets and deploy hooks.2 inside
- app/Your application: models, views, controllers, jobs, mailers, JavaScript and styles.8 inside
- bin/Executable scripts for this app: rails, setup, dev, ci, jobs, kamal and the scanners.13 inside
- config/Application, environment, database, routes, deploy, queue, cache and security configuration.20 inside
- db/Migrations, schema files and seeds for every database the app uses.6 inside
- lib/Code that is not part of the app's domain, and Rake tasks.1 inside
- log/Log files in development and test.
- public/Static files served as they are: error pages, icons, robots.txt.8 inside
- script/One-off and occasional scripts, new in Rails 8.1 inside
- storage/SQLite database files and local Active Storage uploads.
- test/Minitest tests: models, controllers, integration, mailers, jobs, and system tests later.9 inside
- tmp/Caches, pids, screenshots and other temporary files.
- vendor/Third party code you keep in the repository, including pinned JavaScript.1 inside
- .dockerignoreKeeps .git, logs, tmp, storage, master.key and .env files out of the Docker build.
- .gitattributesMarks lock files and encrypted credentials as generated or binary for diffs.
- .gitignoreIgnores logs, tmp, storage, master keys, .env files and public/assets.
- .rubocop.ymlRuboCop config inheriting the Rails omakase style.
- .ruby-versionThe Ruby version for this app, read by version managers, CI and the Dockerfile.
- config.ruThe Rack entry point used by Puma.
- DockerfileProduction image: Ruby, gems, precompiled assets, Bootsnap cache, non-root user, Thruster.
- GemfileRuby dependencies, grouped by environment.
- Gemfile.lockThe exact version of every gem, written by Bundler.
- Procfile.devProcesses `bin/dev` runs together: web server and CSS or JS watchers.
- RakefileLoads Rails tasks and your tasks from lib/tasks.
- README.mdHow to set up, run, test and deploy the app.
Learn more on Sefism
Roadmaps, cheat sheets and projects that go with Ruby on Rails.
- RoadmapBackend development roadmapAPIs, databases, auth, deploys
- RoadmapFull stack development roadmapBuild and ship whole web apps
- RoadmapSQL and databases roadmapQueries, design, indexes, transactions
- RoadmapDevOps and cloud roadmapLinux, Docker, Kubernetes, AWS
- Cheat sheetBackend development cheat sheetAPIs, databases, auth, deploys.
- Cheat sheetFull stack development cheat sheetBuild and ship whole web apps.
- Cheat sheetSQL and databases cheat sheetQueries, design, indexes, transactions.
- FYP idea· BeginnerTuition Centre Fee and Attendance Manager with Parent RemindersA web app for small tuition centres and academies to manage batches, take attendance from a phone, generate monthly fee vouchers and send parents reminders. A beginner-friendly final year project with a real paying customer in almost every neighbourhood.
- FYP idea· AdvancedLightweight Sigma Rule Detection Engine for Small Teams Without a SIEMA single-binary log detection engine for small companies and schools that runs community Sigma rules over Linux, web server and Windows logs in real time, raises clear alerts, and fits on a small VPS instead of a full SIEM stack. An advanced security final year project on rule compilation, streaming matching and alert quality.
See 10 moreShow fewer
- FYP idea· BeginnerAutomated Backup Restore Drills for Small Business DatabasesA backup service for small businesses that does not stop at taking backups: it restores them on a schedule into a throwaway container, checks the data and reports how long recovery really takes. A practical cloud and DevOps final year project for shops, clinics and agencies running MySQL, PostgreSQL or MongoDB on a single server.
- QuestionI understand tutorials but cannot build anything myself. Why does coding feel so different when I am alone?Tutorials train recognition, not production. When you follow along, someone else makes every decision. Building alone requires you to break a problem down and make choices, which is a separate skill. Build it with small projects, planning on paper first, and a rule to struggle before you look anything up.
- QuestionWhat should I learn to become a web developer, and in what order?Learn the web platform first (HTML, CSS, JavaScript, how HTTP works), then one frontend framework, then a backend with a database, and build a real project at each stage. If you already know WordPress, you are not starting over: your HTML, CSS and PHP experience transfers.
- QuestionHow do I learn to read a large codebase when I can handle small projects but get lost in real ones?Nobody reads a large codebase from top to bottom. You follow one real path through it, such as a single request or button click, from entry point to database and back. Map what you find, ignore everything off that path for now, and repeat with a different path. Understanding builds in layers, and a first small change teaches more than a week of reading.
- QuestionDo I need Docker and Kubernetes as a junior developer?Docker, yes: learn the basics, because nearly every team uses containers and you will be expected to run the project locally and read a Dockerfile. Kubernetes, mostly no: understand what it does and a few core terms, but deep Kubernetes can wait until your job or a DevOps direction needs it.
- Resource· GuidePostgreSQL DocumentationThe official PostgreSQL manual for the current release: a tutorial, the full SQL language reference, every data type and function, server administration, and chapters on indexes, EXPLAIN and concurrency control. It is accurate, well written and the place to check any PostgreSQL behaviour before trusting a blog post.
- Resource· GuideDocker Docs: Get StartedDocker's official starting point: install Docker, follow a tutorial that builds, runs and shares a containerised application, then work through short concept pages on containers, images, registries, Compose, image layers, Dockerfiles, the build cache, multi-stage builds, ports and persistent data. It suits developers who have heard of containers but never used them, and it is current, free and more accurate than most tutorials copied from it.
- Resource· GuideOWASP Top TenOWASP's list of the ten most critical web application security risks, now in its 2025 edition, with explanations, example failures and prevention guidance for each. It is the baseline every developer who writes internet-facing code is expected to know, and it is short enough to read in an afternoon. Knowing these categories prevents most of the routine mistakes that cause real breaches.
- Resource· Cheat sheetOWASP Cheat Sheet SeriesThe OWASP Cheat Sheet Series is a free collection of short, expert-written guides on specific security tasks, such as authentication, session management, password storage, input validation, JSON Web Tokens, REST security, XSS and SQL injection prevention. It suits developers who need to implement something securely right now and want a concise list of what to do and which mistakes to avoid, rather than a textbook.
- Resource· GuideGitHub Actions DocumentationThe official documentation for GitHub Actions, GitHub's built in CI/CD and automation system: workflow syntax, triggers, runners, caching, artifacts, environments, secrets and OpenID Connect deployments to AWS, Azure and Google Cloud. Actions is free for public repositories on standard runners, so it is the CI tool most students and open source projects learn first. It suits developers setting up tests and deployments for the first time.
Checked against 20 official sources, October 2026. If something has changed, the docs win.Show sourcesHide sources
- Rails app generator templates (8-1-stable)
- Rails authentication generator templates
- Rails Guides: Getting Started
- Rails Guides: Active Record Migrations
- Rails Guides: Testing Rails Applications
- Rails Guides: Active Job Basics
- Rails Guides: Action Mailer Basics
- Rails Guides: Securing Rails Applications
- Rails Guides: Configuring Rails Applications
- Rails Guides: The Asset Pipeline
- Rails Guides: Working with JavaScript in Rails
- Rails 8.1 release notes
- Kamal documentation
- Solid Queue
- Solid Cache
- importmap-rails
- Hotwire: Turbo and Stimulus
- Brakeman
- Mission Control Jobs
- Packwerk
Best practices and checklists for this stack
Picked from the other libraries by shared topics.
Best practices
See all- REST API Design Best PracticesDesign HTTP APIs clients enjoy using: resources and URLs, methods, status codes, problem details errors, pagination, idempotency keys, ETags, versioning and OpenAPI.
- TypeScript Best PracticesModern TypeScript best practices for 2026: strict settings, TypeScript 7, modeling data with unions, safe narrowing, runtime validation, generics and typed linting.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
Checklists
See all- Database Migration ChecklistCheck a schema or data migration before it ships: expand and contract, lock behaviour, online indexes, batched backfills, rehearsal on real data, backups, rollback, deploy order and monitoring.
- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com