manas-aggrawal/nestjs-boilerplate

A nestJs framework based REST API boilerplate

Summary

A NestJS 11 starter template for building REST APIs in TypeScript, with PostgreSQL, Prisma 6, JWT auth, and Docker wired in. Engineers fork it to skip the initial setup of security middleware, request validation, and database plumbing for a new service. MIT-licensed, it targets Node.js 22.13.0+ and PostgreSQL 16.

What it is useful for

Building authenticated REST services that need a common baseline without hand-rolling each piece. Security defaults are preconfigured: Helmet sets HSTS, X-Frame-Options, and X-Content-Type-Options; @nestjs/throttler provides per-endpoint rate limiting; CORS uses an env-driven origin allowlist; and request bodies are capped at 10 MB. The auth layer ships with three Passport strategies (local, access token, refresh token) and a global AccessTokenGuard that respects @IsPublic() and @AccessTo(Role.ADMIN | Role.STANDARD). Zod schemas via nestjs-zod serve as both runtime validation and Swagger schema input, while Winston handles structured logging to file and console. Biome replaces ESLint and Prettier with a single toolchain that includes import sorting and TypeScript decorator support.

How engineers can use it

Clone the repo, copy .env.example to .env, then run npm run container:init to start the bundled Postgres 16 and API containers. Run npx prisma migrate dev --name init to apply the schema; the API is then reachable at http://localhost:3001 with Swagger UI at /api/docs.

To add a new resource, follow the user/ module pattern: a singular kebab-case folder containing <name>.module.ts, <name>.controller.ts, and <name>.service.ts, plus dto/ and swagger/ subfolders. Define a request DTO by extending createZodDto over a Zod schema, then attach a reusable Swagger decorator like CreateUserSwagger() to the controller method. New Prisma models go into prisma/schema.prisma and are applied with npx prisma migrate dev --name add_<feature>. Code quality runs through npm run check:fix, and the Husky-enforced Conventional Commits spec keeps commit messages structured. Environment variables are imported type-safely from src/configs/env-vars.ts, and path aliases like @user/* and @configs/* replace long relative imports.

A documented caveat: the /forgot-password endpoint returns the reset token in the response, with the README noting that real deployments need to deliver that token through email or another channel. Other known snags include Zod z.date() fields not converting cleanly to Swagger JSON Schema (the README recommends plain @ApiProperty classes for response DTOs), and the project requiring Node 22.13.0 or newer.