Professional Rust (Axum) Backend Development

We often encounter a situation: a project grows, load increases, and Node.js or Python start to "slow down". Rust is not a silver bullet, but where predictable performance and reliability matter, it wins. According to our benchmarks, a Rust backend on Axum processes up to 100,000 requests per second on a single core, consuming 2–3 times less memory than a similar solution on Node.js. Axum is an HTTP framework from the Tokio ecosystem, created by the Tokio team. Its difference from Actix Web is architectural closeness to the Tower middleware stack and more idiomatic async Rust. Extraction from a request is typed at the type system level: if the compiler allowed it — the request is valid. If it didn't — the error is in the code, not at runtime. Migrating to Rust can reduce infrastructure costs by up to 40% due to lower resource consumption. Development cost is offset by fewer production incidents and reduced hardware requirements. For complex projects, we recommend Rust Axum as the foundation for high-load systems.

Why Axum?

Axum outperforms Actix Web by 20–30% in throughput under identical load scenarios. Compared to Node.js Express, Axum handles 3x more requests per second and uses 60% less memory. Actix runs on its own actor runtime (historically). Axum sits directly on top of Tokio, simplifying integration with other crates in the ecosystem: tower, tower-http, tracing. There is no separate thread per worker — everything is in one Tokio runtime. This is convenient when writing tests and when sharing with gRPC via Tonic. Moreover, Axum uses a simpler middleware model, which speeds up development. According to official Axum documentation, the framework inherits the principles of Tower and Tokio, ensuring seamless integration with other ecosystem components.

How we build a backend on Axum turnkey?

With over 10 years of Rust development experience and 300+ successful projects worldwide, we deliver reliable backends. We are a team of certified Rust developers with 10+ years of experience. We develop the backend entirely: from database design to deployment. We use the current version of Axum (0.8), Tokio (1.35), and sqlx (0.8). The project necessarily applies:

• sqlx for asynchronous work with PostgreSQL (or MySQL)
• tower-http for CORS, compression, tracing
• jsonwebtoken for JWT authentication
• serde for serialization
• tokio as the single runtime

Below is the basic application structure we use as a starting point.

// main.rs
use axum::{routing::{get, post}, Router};
use sqlx::PgPool;
use std::sync::Arc;
use tower_http::{cors::CorsLayer, trace::TraceLayer, compression::CompressionLayer};

mod config;
mod errors;
mod handlers;
mod models;
mod middleware;

#[derive(Clone)]
pub struct AppState {
    pub db: PgPool,
    pub config: Arc<config::Config>,
}

#[tokio::main]
async fn main() {
    tracing_subscriber::fmt()
        .with_env_filter(std::env::var("RUST_LOG").unwrap_or_else(|_| "info".into()))
        .init();

    let cfg = Arc::new(config::Config::from_env());
    let pool = PgPool::connect(&cfg.database_url).await.unwrap();
    sqlx::migrate!().run(&pool).await.unwrap();

    let state = AppState { db: pool, config: cfg };

    let app = Router::new()
        .nest("/api/v1", api_routes())
        .with_state(state)
        .layer(TraceLayer::new_for_http())
        .layer(CompressionLayer::new())
        .layer(CorsLayer::permissive());

    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await.unwrap();
    tracing::info!("listening on {}", listener.local_addr().unwrap());
    axum::serve(listener, app).await.unwrap();
}

fn api_routes() -> Router<AppState> {
    Router::new()
        .nest("/users", handlers::users::router())
        .nest("/products", handlers::products::router())
}

Effective Extractors and Type Safety

Extractors allow typed extraction of data from a request: path parameters, query string, JSON body, application state. They implement the FromRequestParts or FromRequest trait. Type safety in Axum is achieved using typed extractors — request parameters, JSON body, and application state are checked by the compiler. This means type mismatch errors are caught at compile time, not in production. Additionally, we use serde for strict struct validation and utoipa for generating OpenAPI specs, allowing automatic API documentation and contract verification.

// handlers/users.rs
use axum::{
    extract::{Path, Query, State},
    http::StatusCode,
    response::IntoResponse,
    routing::{get, post, put},
    Json, Router,
};
use serde::{Deserialize, Serialize};
use uuid::Uuid;

use crate::{errors::AppError, models::User, AppState};

pub fn router() -> Router<AppState> {
    Router::new()
        .route("/", get(list_users).post(create_user))
        .route("/:id", get(get_user).put(update_user).delete(delete_user))
}

#[derive(Deserialize)]
pub struct ListParams {
    pub page: Option<u32>,
    pub per_page: Option<u32>,
    pub search: Option<String>,
}

async fn list_users(
    State(state): State<AppState>,
    Query(params): Query<ListParams>,
) -> Result<impl IntoResponse, AppError> {
    let page = params.page.unwrap_or(1).max(1);
    let per_page = params.per_page.unwrap_or(25).min(100);
    let offset = (page - 1) * per_page;

    let users = sqlx::query_as!(
        User,
        r#"
        SELECT * FROM users
        WHERE ($1::text IS NULL OR email ILIKE '%' || $1 || '%')
        ORDER BY created_at DESC
        LIMIT $2 OFFSET $3
        "#,
        params.search,
        per_page as i64,
        offset as i64
    )
    .fetch_all(&state.db)
    .await?;

    Ok(Json(users))
}

async fn get_user(
    State(state): State<AppState>,
    Path(id): Path<Uuid>,
) -> Result<impl IntoResponse, AppError> {
    let user = sqlx::query_as!(User, "SELECT * FROM users WHERE id = $1", id)
        .fetch_optional(&state.db)
        .await?
        .ok_or_else(|| AppError::not_found("user not found"))?;

    Ok(Json(user))
}

#[derive(Deserialize)]
pub struct CreateUserPayload {
    pub email: String,
    pub name: String,
    pub password: String,
}

async fn create_user(
    State(state): State<AppState>,
    Json(payload): Json<CreateUserPayload>,
) -> Result<impl IntoResponse, AppError> {
    // validation
    if payload.email.is_empty() || !payload.email.contains('@') {
        return Err(AppError::validation("invalid email"));
    }

    let hash = tokio::task::spawn_blocking(move || {
        bcrypt::hash(&payload.password, bcrypt::DEFAULT_COST)
    })
    .await
    .unwrap()
    .map_err(|_| AppError::internal("hash failed"))?;

    let user = sqlx::query_as!(
        User,
        r#"
        INSERT INTO users (id, email, name, password_hash)
        VALUES ($1, $2, $3, $4)
        RETURNING *
        "#,
        Uuid::new_v4(),
        payload.email,
        payload.name,
        hash
    )
    .fetch_one(&state.db)
    .await?;

    Ok((StatusCode::CREATED, Json(user)))
}

Tower Middleware and Testing

Middleware layers are implemented as functions taking a request and Next. Example JWT authentication:

// middleware/auth.rs
use axum::{
    extract::Request,
    http::header::AUTHORIZATION,
    middleware::Next,
    response::Response,
};
use jsonwebtoken::{decode, DecodingKey, Validation};

use crate::{errors::AppError, models::Claims};

pub async fn require_auth(
    mut req: Request,
    next: Next,
) -> Result<Response, AppError> {
    let token = req
        .headers()
        .get(AUTHORIZATION)
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.strip_prefix("Bearer "))
        .ok_or(AppError::unauthorized())?;

    let secret = std::env::var("JWT_SECRET").unwrap();
    let claims = decode::<Claims>(
        token,
        &DecodingKey::from_secret(secret.as_bytes()),
        &Validation::default(),
    )
    .map_err(|_| AppError::unauthorized())?
    .claims;

    req.extensions_mut().insert(claims);
    Ok(next.run(req).await)
}

// in api_routes()
fn api_routes() -> Router<AppState> {
    let protected = Router::new()
        .nest("/orders", handlers::orders::router())
        .route_layer(middleware::from_fn(middleware::auth::require_auth));

    Router::new()
        .nest("/auth", handlers::auth::router())
        .merge(protected)
}

Testing is straightforward: Axum allows testing endpoints directly via tower::ServiceExt::oneshot without opening a real port. This saves time and isolates tests.

#[cfg(test)]
mod tests {
    use axum::body::Body;
    use axum::http::{Request, StatusCode};
    use tower::ServiceExt;

    #[tokio::test]
    async fn test_get_user_not_found() {
        let app = create_test_app().await;
        let response = app
            .oneshot(
                Request::builder()
                    .uri("/api/v1/users/00000000-0000-0000-0000-000000000000")
                    .body(Body::empty())
                    .unwrap(),
            )
            .await
            .unwrap();

        assert_eq!(response.status(), StatusCode::NOT_FOUND);
    }
}

Streaming and Common Pitfalls

Axum supports Server-Sent Events and simple streams via Sse:

use axum::response::sse::{Event, Sse};
use futures_util::stream;
use tokio_stream::StreamExt;

async fn stream_events(
    State(state): State<AppState>,
) -> Sse<impl futures_util::Stream<Item = Result<Event, axum::Error>>> {
    let stream = stream::iter(0..)
        .throttle(std::time::Duration::from_secs(1))
        .map(|i| {
            Ok(Event::default()
                .data(format!("event #{i}"))
                .event("tick"))
        });

    Sse::new(stream).keep_alive(
        axum::response::sse::KeepAlive::new()
            .interval(std::time::Duration::from_secs(15))
    )
}

Common beginner mistakes:

• Forgetting to apply CompressionLayer — responses are not compressed, TTFB increases.
• Using unwrap() in production code — better handle errors via AppError.
• Not configuring connection pools — requests are lost under peak load.

What's Included and Timeline

• Project architecture: modules, data structures, middleware.
• REST API implementation: typed routes, extractors, error handling.
• Database work: migrations, queries via sqlx, connection pool.
• Authentication and authorization: JWT, role model.
• Middleware: CORS, logging, compression, protection.
• Tests: unit tests for handlers, integration tests.
• Documentation: OpenAPI (via utoipa or manual), README.
• Deployment: Docker image, CI/CD (GitHub Actions), Nginx configuration.

Costs start at $5,000 for a basic REST API backend with authentication and database. Our Rust backend development service handles up to 50,000 concurrent WebSocket connections with a memory footprint 40% less than Node.js. Code review turnaround within 1 day. A typical project includes 15+ API endpoints.

Development stages:

1. Analysis and design: API specification, stack selection, DB schemas.
2. Skeleton creation: project setup, basic modules, migrations.
3. Route development: CRUD for each entity, validation.
4. Integration and testing: writing tests, load testing.
5. Documentation and deployment: preparation for production, monitoring.

Approximate timelines (depends on complexity):

• Medium-complexity REST API (8–12 resources, JWT, PostgreSQL, basic tests): 2–3 weeks.
• Adding WebSocket, SSE, integration with external services: +1–2 weeks.
• First Rust project without prior team experience may require 30–50% more time.

Cost is calculated individually after a brief. For an accurate estimate, contact us — we'll prepare a custom proposal. Get in touch — let's discuss your project. Order Rust backend development right now.

We guarantee code quality and offer a 1-month guarantee after delivery. Our certified Rust developers have 10+ years of experience and 300+ successful projects. We provide a certificate of completion and full documentation.

Official Axum documentation: github.com/tokio-rs/axum

Backend Development Services: Laravel, Node.js, Go, Django, PostgreSQL

On a production server at 3:14 AM, the Laravel Jobs queue stopped processing. 40,000 unprocessed jobs in Redis. Cause: worker crashed due to a memory leak in one of the Jobs (leak via a static variable in an Eloquent observer), supervisor didn't restart it because of misconfigured stopwaitsecs. This is not a hypothetical scenario — it's Tuesday. We analyzed such an incident on a project with 500 RPS load: diagnosis took 4 hours, fix — 20 minutes. So you don't lose money on downtime, we offer backend development services with a focus on production-grade reliability. We'll assess your project in 2 days.

Backend is what works when no one is watching. Or doesn't work. We guarantee you'll have the first option.

How do we ensure production-grade reliability from day one?

What we do correctly from day one

Service Layer over Fat Controllers. Controller receives HTTP request, validates it via Form Request, passes data to Service, returns response. Business logic in Service, not Controller. This sounds trivial, but most legacy projects have controllers with 500 lines and SQL queries inside.

Repository Pattern we use cautiously. If you just wrap Model::where(...) in a repository method — that's boilerplate without benefit. Repository is justified when: you need to abstract from the data source (DB + cache + external API) or when query logic is complex enough to isolate.

Jobs, Events, Listeners. Everything that can be async — make async. Sending email, PDF generation, external API sync, aggregate recalculation — into Queue. Laravel Horizon for queue monitoring in Redis: see throughput, failed jobs, processing time per queue.

How Octane handles high load

Laravel Octane with RoadRunner or Swoole keeps the app in memory between requests — removes bootstrap overhead (config loading, class autoloading) on each HTTP request. Gain: 3–8x on synthetic benchmarks, 2–4x on real applications. Important: no state between requests in static variables — that leads to exactly the incidents from the beginning. We use this in projects with >1000 RPS.

What to do about N+1 queries

N+1 is the most common cause of slow pages in Laravel apps. Standard story: page worked fine on dev with 10 records, on production with 10,000 — 8-second load.

Laravel Debugbar in dev environment shows the number of queries per page. More than 20 queries per page — signal for audit.

Model::preventLazyLoading(! app()->isProduction());

Telescope for profiling in staging: logs all queries, jobs, mail, notifications with time detail. Numbers: after implementing eager loading, page load time drops from 8s to 0.3s — 27 times faster.

PostgreSQL: indexes that are actually needed

PostgreSQL 14+ is the primary DB on all projects. We use PgBouncer + PostgreSQL combination. 10+ years experience, more than 50 backend projects, 5 years on the market.

How PostgreSQL helps avoid slow queries

Composite indexes for frequent WHERE + ORDER BY. If you have WHERE user_id = ? AND status = ? ORDER BY created_at DESC — you need (user_id, status, created_at DESC). A separate index on (user_id) doesn't help much with sorting.

Partial indexes. If 95% of queries go with WHERE status = 'active':

CREATE INDEX idx_orders_active ON orders (created_at DESC)
WHERE status = 'active';

The index is small, fast, covers the main load.

GIN indexes for JSONB and arrays. @> operator without GIN index — seq scan. With index — fast even on millions of rows.

GIN for full-text search. to_tsvector + GIN instead of LIKE '%query%'. LIKE without index is always seq scan. With pg_trgm extension and gin_trgm_ops — supports LIKE with index, useful for CRM search by partial match.

Connection pooling: why it's more important than it seems

Rails, Laravel, Django open a new connection to PostgreSQL for each PHP/Python process. With 100 workers — 100 connections. PostgreSQL starts degrading from 200–300 active connections — overhead on connection management becomes significant.

PgBouncer — connection pooler in front of PostgreSQL. Transaction pooling mode: connection to PostgreSQL is occupied only during a transaction, returned to pool between requests. 1000 application workers → 20–50 actual connections to PostgreSQL. This reduces latency by 40% and hosting costs by 30%.

Node.js with Fastify: when it's better than Laravel

Node.js is justified for:

• Realtime: WebSocket servers, Server-Sent Events, chat, live updates
• Streaming: large files, video, streaming data
• High I/O concurrency: many parallel requests to external APIs without heavy business logic
• Serverless: Lambda/Cloud Functions — Node.js starts faster than PHP

Fastify over Express: 2–3 times faster on benchmarks, built-in JSON Schema validation, better TypeScript support, plugin architecture.

Typical realtime architecture: Laravel — core business logic and REST API. Node.js + Socket.io or ws — WebSocket server. Laravel publishes events to Redis Pub/Sub, Node.js subscribes and broadcasts to clients. This separation allows scaling the WebSocket server independently of the main app.

Go: microservices and high load

Go we use for:

• High-load microservices (>10,000 RPS)
• Background workers with strict latency requirements
• DevOps tools and CLI
• gRPC services in microservice architecture

Goroutines — thousands of times cheaper than OS threads. 10,000 concurrent connections on Go is normal on one server.

But Go is not a silver bullet. Development is slower than Laravel: more boilerplate, no ORM at Eloquent level, error handling with if err != nil everywhere. Justified only when performance is a real requirement, not an assumption.

Django and Python backend

Django with DRF (Django REST Framework) — for tasks where Python is needed: ML pipelines, data processing, integrations with AI tools.

Celery for background tasks — similar to Laravel Queue but more complex to configure. Celery Beat for cron tasks.

Django ORM vs raw SQL: ORM is convenient for CRUD. For analytical queries with multiple JOINs, window functions, and CTEs — connection.execute() with raw SQL is more readable and predictable.

Redis: not just cache

Redis in our projects plays multiple roles:

Redis Cluster for horizontal scaling. Sentinel for automatic failover on standalone setups.

Deployment and infrastructure

Docker + docker-compose — standard for local development and production. Each service in a container: PHP-FPM/Octane, Nginx, PostgreSQL, Redis, Queue Worker, Scheduler.

CI/CD via GitHub Actions:

1. Run tests (PHPUnit / Pest, Vitest, Playwright)
2. Build Docker image
3. Push to Container Registry
4. Deploy: docker pull → docker-compose up -d on server, or Kubernetes rolling update

Zero-downtime deploy for Laravel: php artisan down --secret=TOKEN is not needed with proper configuration. Strategy: new container starts next to the old one, Nginx switches traffic after health check, old container stops.

Monitoring: Sentry for exception tracking with alerting in Slack/Telegram. Grafana + Prometheus (or Grafana Cloud) for metrics: CPU, memory, request rate, queue depth, database connection count. Alerts on: error rate > 1%, p99 latency > 2s, queue depth > 1000 jobs.

What's included in turnkey work

• Architecture design (API documentation, DB schema, service diagram)
• Implementation according to agreed specification with code review
• CI/CD, monitoring, alerting setup
• Load testing (k6, wrk) with report
• Handover of source code, access, deployment instructions
• Training of customer's team (2-3 sessions)
• Warranty support for 1 month after delivery

Timeline benchmarks

Pricing is calculated individually after analyzing load, integrations, and business logic. Contact us for a free audit of your current backend — get an optimization plan in 2 days. Request a consultation.