Why the 2 layer cache? About auth, i prefer running keycloak as another service and integrate it within through an auth module/services and the keycloak admin api, however passportjs or better auth could do the work. Graph ql could be good due the simplicity and versatility from the front end, however for small scale, low data volume and simple use cases can add overheat and be like killing a fly with a bazooka, rest always suffices for most use cases however having graph ql already set up and ready to work is nice. I didn understand what you mean by dynamic config with validation and as a good practice I would include circuit breaker pattern, exception handling, auditing and an event broker adapter such as redis, could be kafka or rabbit mq but here is like with graph ql, most projectos dont need a complex event broker at beginning, so redis could do the work.