Kroma App

Overview

Kroma is a cloud-native platform for kromacompany.com that brings together healthcare consulting, educational services, and e-commerce. I own the whole stack — infrastructure (Pulumi), backend (FastAPI on Lambda), and frontend (Nuxt.js 4) — plus the CI/CD that ships them all to AWS.

Kroma logo

Architecture

Loading diagram…

Design

Serverless-first. Every component scales independently. API Gateway triggers Lambda on demand — no servers to manage, no idle cost.

Nuxt.js 4 SSG on S3 + CloudFront. The frontend is fully static, served from S3 with CloudFront for global low-latency delivery. Route53 handles DNS at the edge.

Cognito for auth. User pools manage customers and admins across the business domains. Tokens flow through API Gateway to Lambda authorizers.

DynamoDB as the single data store. Four tables cover transactional and session data; S3 holds the SPA and access logs.

Key decisions

Why serverless. Scale-to-zero removes idle cost for a low-traffic business site; each service scales independently and has a clear billing signal.

Pulumi over Terraform. The infrastructure started on Terraform and was migrated to Pulumi (Python) for real loops and conditionals, keeping the legacy state bucket. Three stacks deploy in order: shared → frontend → backend.

Nuxt SSG on S3, not SSR. Static generation served through CloudFront means CDN pricing and zero servers; the trade-off is that interactive flows go through the API.

Managed identity. Cognito for sign-up and sign-in, with JWT validation at the gateway — no auth code to maintain, roles scoped per business domain.

Clean-architecture FastAPI. Domain, application, infrastructure, and presentation layers keep the backend testable and portable off AWS if we ever need it.

Deploy & observability

GitHub Actions deploys through IAM OIDC — no long-lived keys: aws s3 sync + CloudFront invalidation for the SPA, aws lambda update-function-code for the API. CloudWatch + SNS alarms and AWS Budgets keep cost and health visible.