Sefism Backend Development Roadmap

What it is

Sefism's backend development roadmap is a seven-stage plan for building the server side of real products. It starts with one language and exactly what happens between a client and your server, and ends with two services talking through a gateway, traced end to end. It is about 435 hours of work, and each stage builds on the same project: the schema you design in stage 2 becomes the API in stage 3, which you then secure, speed up, test, ship and split.

Every topic comes with a short explanation, a check question to answer without notes and a study prompt for an AI assistant that quizzes you instead of writing your code. Each stage has a milestone, Tauseef's practical advice, a checklist and resources sorted by what they are for.

By the end you can:

• Design a normalised PostgreSQL schema, write its queries by hand and prove with EXPLAIN that your indexes are used.
• Build a documented REST API with pagination, idempotent writes, versioning and one predictable error shape.
• Secure it with hashed passwords, short-lived access tokens and role checks, and review it against the OWASP API Security Top 10.
• Add Redis caching and a queue-backed worker, then ship the service in Docker through a GitHub Actions pipeline with real tests.
• Explain when an API gateway, circuit breaker, saga or CQRS earns its place, and trace one request across two services.

Seven stacks

You choose a stack when you open the roadmap, and topics, milestones, resources and projects adjust:

• Node.js (the default at /roadmaps/backend/): TypeScript with Express or NestJS, Prisma or Drizzle.
• Python: Django or FastAPI, with the Django ORM or SQLAlchemy and Alembic.
• Java: Spring Boot, JPA, Hibernate and Flyway.
• C#: ASP.NET Core and Entity Framework Core.
• Go: the standard library and small frameworks, with database/sql, pgx or sqlc.
• PHP: Laravel, with PDO and Eloquent.
• Rust: Axum on Tokio, with SQLx.

The database (PostgreSQL), the HTTP and API design ideas, security, caching, testing and architecture are the same for all seven, so the skills transfer if you change stack later.

Who it suits, and who should start elsewhere

It suits people who can already write a little code and want to build backends: students aiming for a first backend or full stack role, frontend developers moving server-side, and engineers in other roles who keep touching APIs.

If you have never written a program, start with Programming foundations. If SQL itself is the gap, the SQL and databases roadmap goes deeper than stage 2 here. If you want to build the browser side as well, Full stack development combines both halves. And if you are not yet comfortable in a terminal and with Git, the short Linux, terminal and Git roadmap will make every stage here smoother.

Time and a weekly plan

The seven stages add up to about 435 hours. Stage 1 (120 hours) is a foundation stage you can skim if you already know your language and HTTP well. The page converts hours to weeks from your chosen pace: about 87 weeks at 5 hours a week, 57 at 8 hours, or 38 at 12 hours.

A student with 12 hours a week: split each week between topics (two evenings) and building the stage milestone on your running project (a long weekend session). At that pace the roadmap takes around nine months.

Someone working full time with 8 hours a week: about a year. If you already code professionally, skim stage 1 and spend the saved time on stages 2 and 4, where most self-taught backend developers have gaps.

Stage by stage

1. Your language and how HTTP works (120 hours, foundation)

The terminal and Git, then your language: syntax and types, collections, errors, modules and packages, and how async work runs in your runtime (the event loop, asyncio, virtual threads, goroutines, Tasks or Tokio depending on stack). Then the network: DNS, TCP and TLS, HTTP requests, responses and headers, methods and status codes. Milestone: a small command line tool with tests, pushed in sensible commits, and every line of curl -v output against a real website explained.

2. Relational databases and SQL (60 hours)

Queries and joins, grouping and aggregates, data modelling and normalisation, keys and constraints, indexes, reading query plans with EXPLAIN, transactions and ACID, isolation levels and locking, migrations and your stack's ORM, and the N+1 query problem. Milestone: a PostgreSQL schema for a small booking or ordering system, the ten queries it needs written by hand, and EXPLAIN ANALYZE showing your indexes are used.

3. Designing and building APIs (60 hours)

Resources, routes and status codes, validating every request, one error shape for every failure, pagination, filtering and sorting, idempotency keys and safe retries, versioning, documenting the contract with OpenAPI and CORS. REST against GraphQL and gRPC, and webhooks and WebSockets, are optional. Milestone: a REST API on your stage 2 schema with validation, cursor pagination, an Idempotency-Key header on create, a versioned path, one consistent error body and an OpenAPI spec that matches the code.

4. Authentication and API security (40 hours)

Authentication against authorisation, password hashing, sessions and cookies, JWT access and refresh tokens, OAuth 2.0 and OpenID Connect, role and object-level authorisation, injection and safe errors, rate limiting, HTTPS and security headers, and a review against the OWASP API Security Top 10. Milestone: sign-up, hashed passwords, short-lived tokens with refresh, role checks and per-user rate limits, then attack your own API and fix at least one broken object-level authorisation or injection flaw.

5. Caching, queues and performance (45 hours)

Measuring latency with percentiles, connection pooling, cache-aside with Redis, TTLs and invalidation, HTTP caching and CDNs, message queues and background workers, at-least-once delivery with idempotent consumers, and reverse proxies and compression. Milestone: load test one endpoint, cache it in Redis with a written invalidation rule, move a slow task such as sending email onto a RabbitMQ queue with a separate worker, and show p95 latency before and after.

6. Testing, CI/CD and deployment (50 hours)

Test levels and test doubles, testing endpoints over HTTP, containers and Dockerfiles, Docker Compose, testing against a real database, config and secrets from the environment, GitHub Actions, health checks and graceful shutdown, and deploys and rollbacks. Milestone: integration tests against a real PostgreSQL, run in GitHub Actions on every push, a production image deployed with environment config and a health check.

7. Architecture and reliability (60 hours)

Monolith first, then service boundaries; logs, metrics and traces; timeouts, retries and backoff; circuit breakers; API gateways and backend for frontend; the transactional outbox; sagas; and replication, sharding and failure modes, with CQRS and service discovery as optional extras. Milestone: split one part of your project into a second service behind a gateway, add timeouts, retries and a circuit breaker on the call between them, and follow one request across both in an OpenTelemetry trace.

Projects that fit

Every stack gets a URL shortener with click analytics and a load test report, municipal complaint tracking with response deadlines, a notification service with retries and a dead letter queue, a measured low-latency read API and distributed tracing for a polyglot microservice system. Some stacks add one more: an API contract checker for CI for Node.js, an agent workflow runner with cost tracking for Python, a key-value store with Raft consensus for Go, and a caching edge proxy with tag-based purge for Rust.

How it works on Sefism

Everything here is free to learn from. The public page shows the full list of seven stages, with the first two stages open to read. Adding the roadmap to your dashboard uses credits: new members get starting credits and the first roadmap you add is free. Once it is on your dashboard, every stage opens, you can track progress topic by topic, the weeks follow your pace, and the companion cheat sheet opens with it. If you are stuck on a design decision or a bug, send Tauseef a question, or book a 1:1 session.

The companion cheat sheet

The Backend development cheat sheet follows these stages chapter by chapter, from HTTP and SQL to architecture, with an essentials chapter for each of the seven stacks. Revise a chapter after each stage, and before a technical conversation.

Related on Sefism

• Sixteen things that break a backend
• Five kinds of API test and when each one earns its place
• Can I get a junior backend job with Rust?
• Should I learn Rust or Go?
• Do junior developers need Docker and Kubernetes?
• Library picks used in the stages: PostgreSQL Exercises, Web Security Academy, OWASP API Security Top 10, DevOps with Docker and Designing Data-Intensive Applications

What you can do afterwards

Apply for backend roles with one project that shows the whole path: schema, API, security, caching, tests, a pipeline and a second service. From here, DevOps and cloud and Platform engineering and SRE take the deployment side further.

FAQ

How long does it take to become a backend developer? This roadmap is about 435 hours: around nine months at 12 hours a week, or a year at 8, ending with a deployed, tested service.

Which backend language should I choose? The roadmap supports seven and keeps the database, API, security and architecture material the same across them. Pick the one used by the companies you want to join and finish the roadmap in it.

Do I need to learn SQL if I use an ORM? Yes. Stage 2 has you write queries by hand and read query plans before relying on the ORM, and covers the N+1 problem ORMs make easy to create.

Is Docker needed for a junior backend role? Stage 6 teaches enough Docker to run a real database in tests and ship a production image, which is what most teams expect.