Node.js in production

Node.js 20 runs inside every Next.js application as the server runtime for API routes and Server Components. The primary role is the query proxy layer: incoming requests from the browser hit a Next.js API route, which applies authentication (Clerk), rate limiting (Redis-backed per-tier), and then proxies the SQL query to ClickHouse over the HTTP interface.

The ioredis 5.3 client handles Redis connections from the Node.js layer. It operates with a connection pool of 10 connections per Next.js instance. The caching pattern is straightforward: before hitting ClickHouse, the API route checks a Redis key with a TTL appropriate to the data freshness requirements (1 hour for daily bars, 5 minutes for regime state, 30 seconds for streaming analytics). On cache miss, the ClickHouse query runs and the result is stored with the correct TTL before returning.

Example workflow: wiring rate limiting into a new API route for a client's metered product. 1. At the top of the route handler, read the Clerk session using auth() and extract the userId and plan tier from session claims. 2. Construct a Redis key: ratelimit:{userId}:{routeName}:{windowMinute} where windowMinute is Math.floor(Date.now() / 60000). 3. Run INCR on the key, then SET its EXPIRE to 60 if the count returned is 1 (first request in this window). 4. If the count exceeds the tier limit (e.g., 60 for Free, 600 for Pro), return a 429 with a Retry-After header. 5. Proceed with the ClickHouse query on success. 6. Log the INCR result to the usage_events ClickHouse table for billing reconciliation at month-end.

The query-proxy case study covers the detailed implementation. The key decision was to implement the proxy in the Next.js layer rather than as a separate service. A standalone Rust proxy was evaluated but eliminated because it would require a separate deployment pipeline and another network hop. The Next.js runtime handles sufficient concurrency for current load (200 concurrent users in load tests, p95 under 500ms) without a separate proxy process.

Node.js is not used for any data ingest, computation, or trading logic. Those paths run in Rust. The boundary is deliberate: Rust handles anything that must be correct and fast under load; Node.js handles anything that benefits from the JavaScript ecosystem (auth libraries, email SDKs, Stripe webhook parsing, Next.js server components).

Cloudflare proxies all traffic before it reaches the Vercel edge, so Node.js never handles TLS termination or DDoS mitigation directly.