Senior review 2 — Python backend, messaging and AWS — prep map

The themes for a senior Python backend role on a Matrix-based messaging product (October 2026): FastAPI and PostgreSQL at the core, Docker and Nginx in front, a Matrix homeserver with push and calls, AWS and Cloudflare around it. Read top to bottom; tick an item once you can explain and defend it under questioning, not merely when you have read it.

The recruiter flagged Nginx/OpenResty, ElastiCache and Route 53 as gaps. Synapse/Matrix, Sygnal and TURN/VoIP are the least common skills on the list and the likeliest “do you have experience with…” questions, so they are marked core too.

Bold is the main read for an item, an Article where one exists. Created 2026-10-15 from existing notes; the seven items no note covered (Matrix and Synapse, Sygnal, FCM, VoIP, STUN/TURN, OpenResty, Cloudflare) were written as new Articles the same day, and their summaries name what each demonstrates, including the local runs.

Priority: 🔴 core (asked, or flagged as a gap) · 🟡 important · 🟢 breadth

🔴 Step 1 — Python and FastAPI

Python at senior level — the object model and reference counting, the GIL and what 3.14’s free-threaded build changes, __eq__/__hash__ contracts, decorators and context managers as API design, what is new in 3.14Memory model The GIL __eq__ vs __hash__Decorators contextlib Python 3.14 features
Async endpoints — def vs async def routes and AnyIO’s thread limiter, a blocking call freezing the loop, offloading with to_thread, timeouts and cancellation that actually stop workFastAPI async run_in_executor and to_thread Cancellation and timeouts asyncio vs threads
Pydantic models — request and response models, validation modes (before/after), settings, the v2 performance model and where validation belongsPydantic models in FastAPI Pydantic in practice Validation modes
Dependency injection — Depends as a graph resolved per request, yield dependencies and cleanup order, overriding in tests, why a request-scoped DB session can hold a connection too longDependencies and injection Connection pooling Testing FastAPI
Middleware — @app.middleware("http") vs pure ASGI middleware, what BaseHTTPMiddleware costs, order of execution, CORSMiddleware Exception handling CORS in depth
Background tasks — BackgroundTasks dies with the process; when work needs a broker (Celery, SQS) and retries; what a deploy does to in-flight workBackgroundTasks vs Celery Async I/O and background work Transactional outbox
REST APIs: design and maintenance — resource modelling, safe and idempotent methods, PUT vs PATCH, versioning and pagination, contract-first design, evolving an API without breaking clientsREST principles PUT vs PATCH Versioning and pagination Contract-first API design Idempotency keys
Code reviews — what review is for (and what CI should catch instead), giving and receiving feedback, review size and latency, typing and linting as review supportPre-commit and code review PR workflow Refactoring Type checking strategy

🔴 Step 2 — PostgreSQL

Indexes — B-tree mechanics, composite column order, partial and covering indexes, GIN/GiST/BRIN, and why a planner ignores an indexIndexes Index types Why your index is not used
Transactions and isolation levels — MVCC, what READ COMMITTED, REPEATABLE READ and SERIALIZABLE each prevent, lost updates and write skew, SELECT ... FOR UPDATE, retries on serialization failureTransactions and isolation Isolation anomalies across databases SQL transactions
Query optimization — reading EXPLAIN (ANALYZE, BUFFERS), estimates vs actuals, pg_stat_statements to find what to fix, N+1 from the ORM, pool sizing by Little’s lawEXPLAIN ANALYZE pg_stat_statements N+1 Connection pooling
Migrations — expand and contract, CREATE INDEX CONCURRENTLY, adding a NOT NULL column without a rewrite, lock timeouts, Alembic in a deploy pipelineZero-downtime migrations Alembic PostgreSQL architecture

🟡 Step 3 — MongoDB

Document modeling, indexes, aggregation, and when to choose it over SQL — embed vs reference by access pattern, compound and multikey indexes with the ESR rule, the aggregation pipeline, write and read concerns, and the honest case for PostgreSQL with JSONB insteadMongoDB Compound and multikey indexes Aggregation pipeline Transactions and concerns SQL vs NoSQL

🔴 Step 4 — Docker

Dockerfiles — layers and cache order, COPY vs ADD, a non-root user, .dockerignore, what makes images large and builds slowImage layers Image vs container ADD vs COPY
Multi-stage builds — build and runtime stages, copying only the artifact, slim vs distroless bases, multi-architecture imagesMulti-stage builds Multi-arch builds
docker-compose — services, healthchecks and depends_on conditions, volumes, profiles, what compose is not (an orchestrator)Docker Compose Volume types
Networking — bridge, host and none networks, service discovery by name, published vs exposed ports, why localhost inside a container is not the hostNetworks: bridge, NAT, host Scaling in Docker

🔴 Step 5 — Nginx and OpenResty (flagged)

Reverse proxy — the worker and event model, location matching order, the proxy_pass trailing-slash rule, headers to forward (X-Forwarded-*), Nginx in front of Gunicorn/UvicornNginx architecture Location matching proxy_pass trailing slash Gunicorn deploy
Load balancing — upstream methods (round robin, least_conn, ip_hash, hash), passive health checks, keepalive to upstreamsUpstream load balancing Load balancers
SSL termination — a modern TLS config, HSTS, OCSP stapling, certificate renewal, what the backend loses when TLS ends at the proxyTLS configuration TLS, HTTPS and certificates
Rate limiting — limit_req as a leaky bucket, burst and nodelay, keying by something other than IP, the real client IP behind a CDN, limit_connRate limiting Secrets and rate limiting
WebSocket proxying — the Upgrade and Connection headers, proxy_read_timeout for long-lived connections, sticky routing — the setup a Matrix homeserver’s sync traffic depends onWebSocket proxying WebSocket scaling WebSocket vs alternatives
OpenResty — Nginx plus LuaJIT: Lua in the request phases (access_by_lua for auth and limits, balancer_by_lua, log_by_lua), cosockets vs anything that blocks the worker, lua_shared_dict across workers (fixed size, LRU when full), ngx.ctx per request; resty.limit.req keyed by API key (its leaky-bucket arithmetic run: 20 requests at 10 r/s burst 5 → 6 served with 0-0.5 s delays, 14 rejected) and per-instance limits; edge JWT checks and header trust; vs auth_requestOpenResty: Lua inside Nginx Nginx rate limiting Nginx architecture Nginx alternatives

🔴 Step 6 — Matrix messaging stack (niche, flagged)

Matrix and Synapse — rooms as replicated event DAGs (PDUs vs EDUs, prev_events, auth_events, state keyed by type and state_key); how a server trusts a relayed event (run with canonicaljson/signedjson: a rewritten body keeps the event ID and signature but fails the content hash and is shown redacted; a changed sender breaks both); state resolution and room version 12 (State Resolution v2.1, Project Hydra); /sync long polling and Simplified Sliding Sync; federation discovery, 8448 and .well-known; Synapse 1.163 workers over Redis, /sync routed per user, initial syncs isolated; state_groups_state growthMatrix and Synapse WebSocket proxying Short vs long polling Consensus and leader election
Sygnal (push gateway) — why the homeserver does not call FCM itself (the app publisher’s credentials); pusher registration and app_id; the /_matrix/push/v1/notify contract run locally: the full format sends the message body to Google or Apple, event_id_only sends only IDs and counts, and rejected pushkeys must be deleted; encrypted rooms and client-side push rules; Sygnal 0.17 config (FCM v1 service account, APNs .p8 token auth); expired certificates, sandbox vs productionSygnal: the Matrix push gateway FCM and APNs Notification fan-out
Firebase Cloud Messaging — registration tokens per install; HTTP v1 with a service-account JWT exchanged for a 1-hour OAuth token, and APNs ES256 provider tokens from a .p8 key (both generated locally with PyJWT); notification vs data messages, priority and deprioritisation, mutable-content, collapse keys, ~4 KB payloads; errors as instructions (UNREGISTERED → delete), firebase-admin 7 send_each; token hygiene (270-day Android expiry); the legacy API shut down from July 2024FCM and APNs Sygnal Notification fan-out Notification center

🔴 Step 7 — Real-time: VoIP, STUN and TURN (flagged)

VoIP over WebRTC — signalling as m.call.* room events (invite, candidates, answer, select_answer, negotiate, hangup), media never through the homeserver; every device rings and party_id picks one; invite lifetime, glare by the smaller call_id, batched candidates (and the IP addresses they put in room history); GET /voip/turnServer and Synapse’s turn_shared_secret; group calls: mesh uploads N-1 streams, so MatrixRTC with a LiveKit SFU and lk-jwt-serviceVoIP calls on Matrix STUN, TURN and coturn WebRTC and WebTransport
STUN vs TURN, and coturn — NAT mapping types decide whether a direct path exists (run: one socket, two STUN providers, two different public ports → symmetric NAT, TURN needed); ICE candidates host, server-reflexive, relay; TURN relay bandwidth cost; time-limited REST credentials (HMAC of expiry:user); a coturn config with TLS on 443, relay range, quotas and denied-peer-ip for private, link-local and metadata ranges, and the 2026 CVEs that bypassed it with IPv4-mapped IPv6 (upgrade to 4.16+); placement, metrics, “no audio” debuggingSTUN, TURN and coturn NAT VoIP calls on Matrix TCP vs UDP

🟡 Step 8 — AWS (ElastiCache and Route 53 flagged)

EC2 — instance families and sizing, AMIs and launch templates, security groups vs NACLs, instance profiles instead of keysEC2 AWS interview essentials
ElastiCache (flagged) — Redis/Valkey vs Memcached, cluster mode on and off, endpoints, failover and what a client sees during it, connection pools on Kubernetes, cache-aside, sessions and pub/subElastiCache Failover and serverless What is Redis Cache consistency
Route 53 (flagged) — hosted zones, alias vs CNAME at the zone apex, routing policies (weighted, latency, failover, geolocation), health checks, TTLs during a cutoverRoute 53 DNS
Secrets Manager — storing and rotating credentials, the rotation Lambda, caching secrets in the app, Parameter Store as the cheaper optionSecrets Manager Rotation and Parameter Store
CloudWatch — logs, metrics and alarms, metric filters, alarms on percentiles, the cost traps (high-cardinality custom metrics, log ingestion)CloudWatch Cost and advanced patterns SLOs and burn rates
S3 — presigned URLs for direct uploads and downloads, bucket policies vs IAM, Block Public Access, storage classes and lifecycle rulesS3 File uploads CDN and signed URLs

🟡 Step 9 — Cloudflare (edge)

Cloudflare — proxied vs DNS-only and the anycast edge (run: this site’s names resolve inside Cloudflare’s 15 IPv4 and 7 IPv6 ranges; Server, CF-Ray, CF-Cache-Status headers); SSL modes (Flexible’s redirect loop, Full (strict) with an Origin CA certificate); what is cached by default (extensions, not HTML or JSON, never with Set-Cookie); restoring the client IP from CF-Connecting-IP for trusted ranges only; locking the origin (firewall, Authenticated Origin Pulls, Tunnel); 52x errors and the 125 s timeout; Matrix behind it: 8448 is not proxied, so .well-known delegation to 443, TURN stays DNS-onlyCloudflare in front of your origin CDN DNS Load balancing and CDN

🟡 Step 10 — Non-functional: reliability, security, performance, scaling

Monitoring — SLIs and SLOs, burn-rate alerts over two windows, the three pillars, tracing across servicesSLOs and error budgets Three pillars OpenTelemetry
Caching — cache-aside and its races, invalidation, stampedes, what not to cacheCache consistency Cache stampede HTTP semantics and caching
Horizontal scaling — stateless services, sticky sessions and why to avoid them, load balancing, read replicas and their lagStateful vs stateless Load balancing and CDN Replication and consistency
Secrets handling — where secrets live and why workload identity beats any stored secret, rotation, never in images or logsSecrets and configuration Secrets Manager Secrets and rate limiting
Reliability and performance under load — timeouts, retries with backoff and jitter, circuit breakers, connection pools, profiling before optimizingTimeouts, retries, backoff Circuit breakers and bulkheads Connection pooling Memory profiling