Project structure · Backend
Rust with Axum project structure
Opens with creditsA REST API for an orders app in Rust, built on Axum, Tokio and SQLx with tower middleware. A thin main.rs starts a library crate split into routes, extractors, domain types, repositories and services, and SQL is checked against PostgreSQL at compile time. For students who know basic Rust and want to see how a real service is laid out, from cargo new to a workspace a team can maintain for years.
Curated by Tauseef FayyazAdvanced143 files and foldersRust 1.99 (edition 2024), Axum 0.8, Tokio 1.53Checked October 2026How it grows
Each stage opens the explorer there
- 1Day 1What the scaffold and your first hour give you9 files and folders
- 2GrowingWhat a real app with features and tests adds+68 files and folders
- ProductionWhat running it for real users adds+33 files and foldersOpens with credits
- ExpertWhat a team needs to keep it healthy for years+33 files and foldersOpens with credits
How it is organised
- A thin binary over a library: `main.rs` only loads config and starts the server, everything else is in `lib.rs` modules, because integration tests can only import a library crate.
- Handlers stay thin: extractors pull typed data out of the request, a service does the work, `AppError` turns failures into responses. Business rules never live in a handler.
- Parse, do not validate: newtypes such as `Email` and `Money` can only be built through a checking constructor, so the rest of the code trusts its inputs.
- Plain SQL, checked at compile time: SQLx macros verify every query against the real schema, and `.sqlx/` lets CI and Docker build without a database.
- One error type per layer, joined with `?`: domain errors and `sqlx::Error` convert into `AppError`, which logs details and shows clients a safe message.
- Shared state is cheap to clone and created once: the pool, config and HTTP client live in `AppState`; nothing per request is stored in memory that a second replica would not see.
- Use tower middleware before writing your own: tracing, timeouts, request ids, CORS and compression already exist in tower-http.
- Tests grow in layers: unit tests next to the code, `#[sqlx::test]` integration tests with a fresh database each, Hurl journeys against the built image, then snapshots, benchmarks and mutation tests for a team.
- Boundaries become crates when they start to drift: the domain moves into its own workspace crate so the compiler, not code review, keeps web and database code out.
At the top of the project
Open one in the explorer for the full story
- orders-api/
- .git/Git history. `cargo new` runs `git init` for you.
- .gitignoreTells Git to skip `target/`, and later `.env` and editor files.
- Cargo.tomlThe package manifest: name, edition, dependencies, lints and build profiles.
- Cargo.lockThe exact version of every crate in the build, written on the first `cargo build`.
- target/Build output: compiled dependencies, your binaries, incremental caches.
- README.mdHow to set up, run, test and deploy the service.
- rust-toolchain.tomlPins the Rust version and components (rustfmt, clippy) for everyone.
- src/All Rust source for the service: a thin binary in main.rs and a library in lib.rs.16 inside
- migrations/SQL migrations, one timestamped file per change, applied by SQLx.2 inside
- .sqlx/Saved query metadata from `cargo sqlx prepare`, so builds work without a database.
- config/Non-secret settings per environment, layered by the `config` crate.2 inside
- .envLocal secrets and `DATABASE_URL` for sqlx-cli and the query macros.
- .env.exampleEvery environment variable the service needs, with safe placeholder values.
- compose.yamlPostgreSQL for local development, and later the API itself.
- rustfmt.tomlFormatting options for `cargo fmt`, such as import grouping.
- clippy.tomlClippy settings, such as the allowed cognitive complexity or disallowed methods.
- .vscode/Shared editor settings for VS Code and rust-analyzer.2 inside
- .cargo/Cargo settings for this repository: aliases and linker options.1 inside
- justfileShort commands for common tasks: `just dev`, `just test`, `just prepare`.
- tests/Integration tests: each one builds the real router and calls it over HTTP.1 inside
Learn more on Sefism
Roadmaps, cheat sheets and projects that go with Rust with Axum.
- Roadmap· RustBackend development roadmapAPIs, databases, auth, deploys
- Roadmap· PostgreSQLSQL and databases roadmapQueries, design, indexes, transactions
- RoadmapDevOps and cloud roadmapLinux, Docker, Kubernetes, AWS
- Cheat sheetBackend development cheat sheetAPIs, databases, auth, deploys.
- Cheat sheetSQL and databases cheat sheetQueries, design, indexes, transactions.
- FYP idea· BeginnerBreached Password and Credential Stuffing Guard Middleware for Small Web AppsBuild drop-in middleware for Express, Django or Laravel that protects login and sign-up forms in two ways: it refuses passwords that appear in known breaches using a privacy-preserving lookup, and it detects credential stuffing attacks from patterns across many login attempts. It is aimed at small e-commerce, school and clinic sites that cannot afford an enterprise bot management product.
- FYP idea· IntermediateApproval Workflow Engine with Escalations for Small OfficesAn approval workflow engine for small offices, schools and NGOs that turns purchase requests, leave, reimbursements and document sign-offs into tracked flows with deadlines, escalations and email or WhatsApp-style reminders. A no-code automation final year project with a durable workflow runtime and an audit trail.
- FYP idea· AdvancedFair Scraper Gate for Small Websites with Adaptive Proof of Work and Signed AI Agent VerificationBuild a self-hosted reverse proxy that protects small websites from aggressive AI scrapers while staying fair to real people on cheap phones and to well-behaved agents that identify themselves. It combines adaptive proof-of-work challenges with verification of cryptographically signed bot requests, and measures the cost it puts on low-end devices. University sites, open source forges and small archives are the people who need it most.
- QuestionShould I learn Rust or Go in 2026?For most backend, cloud and DevOps work, learn Go first: it is small, quick to get productive in and common in cloud tooling. Choose Rust if you want systems programming, performance-critical code, embedded or you enjoy going deep on how memory works. Neither is a good first language if you cannot yet build software in another one.
See 8 moreShow fewer
- QuestionCan I get a junior backend job with Rust, or should I learn it as a second language?You can, but Rust backend roles for juniors are fewer than for Node.js, Python, Java or Go, and many ask for experience. The safest plan is one mainstream backend stack for your first job and Rust as a strong second language, unless you are applying to the specific companies and teams that hire juniors into Rust.
- QuestionHow do I learn to read a large codebase when I can handle small projects but get lost in real ones?Nobody reads a large codebase from top to bottom. You follow one real path through it, such as a single request or button click, from entry point to database and back. Map what you find, ignore everything off that path for now, and repeat with a different path. Understanding builds in layers, and a first small change teaches more than a week of reading.
- QuestionDo I need Docker and Kubernetes as a junior developer?Docker, yes: learn the basics, because nearly every team uses containers and you will be expected to run the project locally and read a Dockerfile. Kubernetes, mostly no: understand what it does and a few core terms, but deep Kubernetes can wait until your job or a DevOps direction needs it.
- Resource· GuideAxum DocumentationThe official docs and examples for Axum, the Tokio team's web framework for Rust. Learn routing, extractors, shared state, error handling and tower middleware, then use the examples folder in the repository as a cookbook for real APIs.
- Resource· BookThe Rust Programming LanguageThe official Rust book, free to read online and usually called simply "the book". It teaches ownership, borrowing, enums, error handling, traits, generics, closures, concurrency and async in a sensible order, with small projects along the way. Start here before any web framework.
- Resource· GuideTokio TutorialThe official tutorial for Tokio, the async runtime under Axum, SQLx and most Rust network code. You build a small Redis client and server step by step and learn tasks, shared state, channels, I/O, framing, select and streams on real code.
- Resource· GuideSQLx DocumentationThe docs for SQLx, the async SQL toolkit most Axum projects use with PostgreSQL. Plain SQL with query macros checked against your real schema at compile time, connection pools, transactions, migrations and an offline mode for CI.
- Resource· BookZero To Production In RustLuca Palmieri's book on backend development in Rust: you build a real email newsletter API from scratch with integration tests, structured logging, error handling, authentication, CI and deployment. The best end-to-end picture of a production Rust service.
Checked against 19 official sources, October 2026. If something has changed, the docs win.Show sourcesHide sources
- The Cargo Book: cargo new
- The Cargo Book: Package layout
- The Cargo Book: Workspaces
- axum documentation
- axum examples
- Tokio tutorial
- tower-http documentation
- SQLx repository and README
- SQLx CHANGELOG (0.9.0)
- sqlx-cli README
- tracing-subscriber documentation
- config crate documentation
- cargo-nextest
- cargo-deny book
- cargo-chef
- release-plz
- insta snapshot testing
- Hurl documentation
- Rust release channel (stable 1.99.0)
Best practices and checklists for this stack
Picked from the other libraries by shared topics.
Best practices
See all- REST API Design Best PracticesDesign HTTP APIs clients enjoy using: resources and URLs, methods, status codes, problem details errors, pagination, idempotency keys, ETags, versioning and OpenAPI.
- TypeScript Best PracticesModern TypeScript best practices for 2026: strict settings, TypeScript 7, modeling data with unions, safe narrowing, runtime validation, generics and typed linting.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
Checklists
See all- Database Migration ChecklistCheck a schema or data migration before it ships: expand and contract, lock behaviour, online indexes, batched backfills, rehearsal on real data, backups, rollback, deploy order and monitoring.
- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com