Single sign-on: What we learned during our identity alpha(gds.blog.gov.uk)

  - front end: Vue and JavaScript, or whatever's popular and easy to use
  - back end: Java with Dropwizard, or whatever has decent performance, decent maintainability (static types) and isn't too slow to write code for by the average developer (as opposed to something like Rust or C++)
  - database: PostgreSQL, or whatever is suitable for its needs (though open source, so otherwise MariaDB could be considered)
  - infrastructure: x86 servers, all running something like Ubuntu LTS or another popular, relatively stable distro
  - communication: REST everywhere with OpenAPI, due to their abundance

  - all of the code must be open source
  - all of the discussions about the code and requirements must be public (a la GitLab's approach)
  - all of the services must follow 12 Factor App principles, have fully automated CI and must run in containers (say, Docker or anything OCI compatible, with a simple orchestrator, like Nomad or K3s)
  - all of the non-trivial services (e.g. files, reports etc.) must be separate, so not exactly monoliths, but not necessarily Netflix level of microservices
  - all of the services must have at least 75% method code coverage, separation of concerns, all methods longer than X lines must have comments explaining what they're doing and *why*
  - all of the services must use dependencies that are not older than X months, checked weekly
  - all of the above can be checked by a bunch of shell scripts and the CI pipelines will fail if the goals are not met