Darway

01The Problem & Rental Workflow

Rental platforms must bridge two distinct user needs: discovery of verified property listings and instantaneous direct communication between prospective tenants and landlords. In rental markets, slow inquiry feedback leads directly to tenant churn.

At the same time, public-facing listing platforms are frequent targets of credential stuffing, SQL injection attempts, automated scrapers, and malicious message payloads sent over open web channels. The challenge was enabling frictionless real-time messaging while maintaining a strict perimeter defense.

02My Verified Contribution

Darway was built as a collaborative team project. I deliberately owned specific foundational pillars rather than claiming ownership of the entire application:

• Socket.IO Real-Time Chat Service: Architected the bi-directional messaging subsystem, handling connection authentication, room isolation per rental listing inquiry, and real-time read receipts.
• WAF & ModSecurity Hardening: Configured Web Application Firewall (WAF) rule sets via ModSecurity behind the Nginx reverse proxy, filtering bad user agents, path traversal, and script injection payloads before requests hit application routes.
• Application Protection Logic: Implemented rate limiting, request validation, and sanitized input boundaries across API endpoints.
• Testing & GitHub Actions CI/CD: Formatted automated test pipelines running unit and integration suites on pull requests, ensuring containerized test databases spin up cleanly in GitHub Actions.

03Architecture & Key Decisions

The system utilizes Fastify with TypeScript for its core backend API. Fastify was chosen over traditional Express or heavyweight opinionated alternatives due to its built-in schema compilation (Ajv), providing sub-millisecond route parsing and predictable typing.

Data persistence relies on PostgreSQL managed through Prisma schema migrations. Docker Compose provides deterministic local development environments, bundling PostgreSQL, Nginx, and Node runtimes with zero external configuration drift.

04Tradeoffs & Lessons

Running ModSecurity rules at the Nginx layer added noticeable latency during initial tuning until regex rules were audited and pruned of redundant inspection chains. Furthermore, maintaining Socket.IO state across scaled backend instances necessitates redis-backed adapters when moving beyond single-node prototypes.

05Current Status & Next Steps

The collaborative codebase is preserved on GitHub. The chat engine and security integration are verified in local and CI environments. Production hosting is currently unconfirmed. Future improvements would include Kafka event streaming for decoupling notification delivery from chat state.