Why it is worth attention

It provides a complete, opinionated starter with two authentication strategies (JWT and Spring Session), built-in rate limiting, Flyway migrations, and a full CI/CD pipeline to deploy to EC2, saving hours of initial project configuration.

Who it is for

Java/Spring Boot developers starting new REST API projects
Teams needing a standardized, secure API template with authentication
Developers who want a Dockerized setup with Nginx and MySQL
CI/CD practitioners looking for a ready-to-use GitHub Actions workflow

Use cases

Building microservices or monolithic REST APIs with user authentication
Rapid prototyping of secure backend services with minimal setup
Teaching or learning Spring Boot security, JWT, and DevOps patterns
Internal tool APIs requiring role-based access and rate limiting

Strengths

Comprehensive feature set including JWT with refresh token rotation, RBAC, and rate limiting via Bucket4j
Two parallel authentication approaches (JWT and Spring Session) to suit different client types
Fully containerized with Docker Compose, Nginx reverse proxy, and MySQL
Automated CI/CD pipeline that tests, builds Docker images, and deploys to EC2

Considerations

JWT token statelessness means revocation requires refresh token invalidation; not ideal for browser-based apps without Spring Session
Assumes use of MySQL or H2; no built-in support for other databases
Default admin credentials are seeded and must be changed via environment variables before production deployment

README quick start

🚀 Spring Boot Starter Kit

Stop copy-pasting boilerplate. Clone this, rename the package, and ship.

A production-ready Spring Boot 3 REST API template with everything you need baked in — JWT auth, rate limiting, Swagger docs, Docker, GitHub Actions CI/CD, and more.

✨ Features

Feature	Details
🔐 JWT Authentication	Access token (15 min) + Refresh token (7 days) with rotation
👮 Role-Based Access Control	`ROLE_USER` and `ROLE_ADMIN` via `@PreAuthorize`
🚦 Rate Limiting	Per-IP rate limiting using Bucket4j (configurable)
📄 OpenAPI 3 / Swagger UI	Auto-generated docs at `/swagger-ui.html`
🛡️ Global Exception Handling	Consistent `ApiResponse` across all endpoints
🗃️ Flyway Migrations	Version-controlled schema with rollback support
🐳 Docker + Docker Compose	Multi-stage build, nginx reverse proxy, MySQL
⚙️ CI/CD via GitHub Actions	Test → Build → Push Docker → Deploy to EC2
📊 Actuator	`/actuator/health`, `/actuator/metrics`
🔍 Request ID Tracking	MDC-based request ID in every log line
🌍 CORS Configured	Configurable via environment variables
✅ Bean Validation	Jakarta Validation on all request DTOs

📁 Project Structure

src/main/java/com/starterkit/
├── config/              # Security, Swagger, DataInitializer
├── controller/          # AuthController, UserController, HealthController
├── dto/
│   ├── request/         # RegisterRequest, LoginRequest, RefreshTokenRequest
│   └── response/        # ApiResponse, AuthResponse, UserResponse
├── entity/              # User, Role, RefreshToken
├── exception/           # GlobalExceptionHandler + custom exceptions
├── filter/              # JwtAuthFilter, RateLimitFilter, RequestIdFilter
├── repository/          # JPA repositories
├── security/            # JwtService, UserDetailsServiceImpl
└── service/             # AuthService, UserService

🚀 Quick Start

Prerequisites

Java 17+
Maven 3.8+
Docker & Docker Compose

Option 1 — Run locally (H2 in-memory, zero setup)

git clone https://github.com/raahulllkushw

Description

🚀 Production-ready Spring Boot 3 starter — JWT, Rate Limiting, Swagger, Docker, CI/CD Public ✅

Related repositories

Similar projects matched by category, topics, and programming language.

oversecured

Samsung_Vulnerabilities

Oversecured discloses a report of 176 vulnerabilities discovered in Samsung preinstalled apps between 2022 and 2025, with 140 detailed, all fixed in collaboration with Samsung.

Java

310

wxxsfxyzm

MiuiBackGestureHook

An LSPosed module that hooks MIUI SystemUI back gestures using modern Xposed API 102 for research and customization.

Java

SangLuoCN

OneStep4

OneStep4.0 is a multi-window desktop container for Android that requires root or system-level privileges, enabling a main window with several side windows for efficient app multitasking.

Java