2026
Pinball PVP API
Programmer
A REST API built with ASP.NET Core (.NET 10) and PostgreSQL, backing an unreleased Unity head-to-head pinball game. Handles player accounts and authentication, tracks solo and player-vs-player matches, and maintains aggregated player records (wins, losses, highscores) as the foundation for in-game leaderboards.
Source on GitHub ↗Open source
Backend & Data
- Designed the API's data models and endpoints using ASP.NET Core (.NET 10), with Entity Framework Core (via Npgsql) handling data access against a PostgreSQL database, using EFCore.NamingConventions for snake_case naming.
- Implemented player account management, solo (vs CPU) and versus (P2P) match tracking, and paginated leaderboards ranked by highscore, wins, and win rate, each supporting period filters (week, month, year).
- Built a yearly rollover system that snapshots the top 3 players per leaderboard category, resets year-to-date player records, and prunes old match history to keep the database size bounded.
- Versioned all routes under /api/v1 so shipped game clients aren't broken by future API changes.
Authentication & Security
- Implemented JWT bearer authentication with refresh token rotation, and Argon2 password hashing for stored credentials.
- Built an email-based password recovery flow using time-limited recovery codes.
- Designed a dual-confirmation flow for versus matches, requiring both participants to independently submit matching results before a match is recorded, preventing one-sided result forgery.
- Added sliding-window rate limiting (5 requests per minute per IP) on login and registration endpoints to mitigate abuse.
Testing
- Covered core API logic with unit tests using xUnit, and full-stack integration tests using Testcontainers to run each test suite against a real, isolated PostgreSQL instance.
Observability
- Implemented structured logging with Serilog, and a correlation ID middleware that attaches a unique trace ID to every request for cross-service debugging.
- Exposed a /health endpoint reporting database connectivity status, suitable for container orchestration liveness and readiness probes.
Infrastructure & Deployment
- Containerized the API and PostgreSQL database as separate services using Docker and Docker Compose, keeping the application and data layers isolated and independently deployable.
- Built a GitHub Actions CI/CD pipeline that runs the full test suite, builds and pushes a production Docker image to GitHub Container Registry, and deploys it automatically on every push to master.
- Solved a CGNAT networking constraint on the self-hosted deployment target by joining both the GitHub Actions runner and the host machine to a private Tailscale network, then driving the deployment over an SSH connection tunneled through it, with no public ports exposed.
- Automated daily PostgreSQL backups, mirroring dumps to Google Drive via rclone and sending email alerts on failure.
Technologies
- C#
- ASP.NET Core (.NET 10)
- Entity Framework Core
- Npgsql
- PostgreSQL
- Docker
- Docker Compose
- GitHub Actions
- xUnit
- Testcontainers
- Serilog
- Tailscale
- Argon2
- JWT Authentication
- Swagger/OpenAPI