---
title: "The System Design Behind My New SaaS"
url: https://daily.dev/posts/the-system-design-behind-my-new-saas-n2rai39sp
source_url: https://milanjovanovic.tech/blog/the-system-design-behind-my-new-saas
type: article
source: "Milan Jovanović"
published: 2026-07-24T20:01:06.285Z
updated: 2026-07-24T22:18:27.536Z
tags: ["career", ".net", "self-hosting"]
reading_time: 10
upvotes: 49
comments: 6
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# The System Design Behind My New SaaS

**[Milan Jovanović](https://daily.dev/sources/milanjovanovic)** · 10 min read · 49 upvotes · 6 comments

## Summary

A detailed walkthrough of the system design behind Katabench, a .NET coding platform that safely executes arbitrary C# code submitted by users. The architecture uses three Hetzner VPS servers: one for the .NET API and Postgres, one for isolated code execution sandboxes, and one for deployment and observability. All servers are connected via a self-hosted Headscale/WireGuard VPN with no public exposure beyond ports 80/443. Code submissions flow through NATS JetStream to a worker that spins up throwaway containers with no network access and strict resource limits. The observability stack uses Grafana, Loki, Tempo, and Prometheus fed by OpenTelemetry collectors. Auth is delegated to Clerk and payments to Paddle (as merchant of record), while everything else is self-hosted on a fixed monthly cost.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://milanjovanovic.tech/blog/the-system-design-behind-my-new-saas>

## Community discussion

Top comments from developers on daily.dev.

**@trevorsuna** · 5 upvotes

> Love the split here: buy auth and payments, own the core, and isolate untrusted code hard. Three small servers with clear jobs feel easier to reason about than a pile of managed services, imo.

**@ajaychoudhary80** · 0 upvotes

> Container isolation, network restrictions, and message queues make for a strong defense-in-depth approach.

## Similar posts on daily.dev

- [Scaling to 100k\+ Products: A Resilient .NET 10, K8s, and Next.js 15 Event-Driven Architecture](https://daily.dev/posts/scaling-to-100k-products-a-resilient-net-10-k8s-and-next-js-15-event-driven-architecture-w4juev2fb) · Medium · 17 upvotes · 0 comments
- [How I Built a KiloClaw Dashboard that Does Work for Me](https://daily.dev/posts/how-i-built-a-kiloclaw-dashboard-that-does-work-for-me-q6ltkomhz) · Kilo Blog · 62 upvotes · 2 comments

---

Tags: [#career](https://daily.dev/tags/career), [#.net](https://daily.dev/tags/.net), [#self-hosting](https://daily.dev/tags/self-hosting)

[View this post on daily.dev](https://daily.dev/posts/the-system-design-behind-my-new-saas-n2rai39sp)