Biddy

Paystack rather than Stripe, because local card and bank-transfer coverage and roughly 1.5% + ₦100 fees are what actually work for Nigerian sellers. Deployment goes GitHub Actions → a container image on GHCR → SSH deploy onto a VPS, rather than a managed platform: predictable cost in a market where margins are thin, and no per-invocation surprises during a traffic spike.

Listing moderation is a different job from shopping, done by different people under different pressure, so it lives in a separate admin application on its own subdomain. Staff approve pending products to live, demote live products back to pending with a reason attached, manage accounts, and handle returns and orders. Signup is token-gated so only invited staff can register — the alternative is an admin panel one leaked password away from the catalogue.

Checkout, listings, notifications and moderation don't share a failure mode, so they don't share a process. They're separate services communicating over NATS.io, which means a notification backlog doesn't stall a checkout and a moderation deploy doesn't take the catalogue down. Authentication was centralised behind Keycloak rather than reimplemented per service — one place for sessions, roles and SSO, which is also the only sane way to keep the staff console and the storefront honest about who a user is.

The part that changed how I work wasn't the architecture, it was being the person paged when the marketplace broke. Sentry for error tracking, Upstash Redis for rate limiting and caching, Pusher for realtime, a PWA layer for repeat mobile buyers. Every one of those went in because something failed first.