Overview
A production-grade real-time multiplayer quiz platform built as a multi-tenant architecture, designed to handle 100+ concurrent users across multiple simultaneous game rooms. Currently running two production sites:- PistolQuiz (general knowledge: culture, science, history, sports)
- FreestyleQuiz (freestyle football trivia: battles, events, champions, legends)
Production Architecture
Scalability & Performance
The system is built for production workloads with a focus on low-latency, high-concurrency real-time communication:- Socket.IO WebSockets with sub-100ms event delivery across all connected clients
- Event-driven game engine processing buzz events, answer submissions, and state transitions with zero blocking I/O
- In-memory game state for instant read/write (no database round-trips during gameplay)
- Per-room isolation ensures game logic is independent, allowing 20+ rooms running simultaneously
- Graceful shutdown with full timer cleanup, socket disconnection, and state persistence
Infrastructure
| Component | Technology | Role |
|---|---|---|
| Frontend CDN | Vercel + Cloudflare | Global edge caching, SSL termination, DDoS protection |
| Backend | Hetzner VPS (Node.js) | WebSocket server, game engine, JWT auth |
| Process Manager | PM2 | Auto-restart, log management, zero-downtime reloads |
| CI/CD | GitHub Actions | Automated lint, type-check, build, and test pipeline |
| Monitoring | Custom /stats endpoint | Real-time room count, player count, memory usage |
Security
- JWT authentication with per-room scoped tokens and host privilege escalation
- Server-side state authority prevents client-side tampering (scores, answers, timers all server-authoritative)
- Sanitized spectator data strips all answer fields before broadcasting to spectators
- Rate limiting on all socket events with IP-based throttling
- Input validation with XSS sanitization via DOMPurify on all user inputs
- CORS whitelisting per-site with origin validation
Multi-Tenant Architecture
A single codebase serves multiple quiz brands with full isolation:- Site resolution via HTTP Origin or X-Site-ID header on every request
- Per-site configuration: timers, categories, themes, branding, SEO metadata, OG images
- Shared game logic with site-specific data directories (questions, assets)
- Dynamic asset pipeline: prebuild script generates site-specific index.html, copies branded assets
Real-Time Features
- Reconnection resilience: 30s grace period with cancellable forfeit timers, auto-reconnect with exponential backoff
- Fuzzy answer matching: Levenshtein distance + Jaro-Winkler similarity with adaptive thresholds based on answer length
- Live spectator mode: Real-time game viewing with server-side answer sanitization
- Bilingual support: Full French/English i18n with 346 translation keys
Tech Stack
| Layer | Technologies |
|---|---|
| Frontend | React 18, TypeScript, Vite, Tailwind CSS, Framer Motion, Zustand, i18next |
| Backend | Node.js, Express, Socket.IO, JWT, Zod |
| Infrastructure | Vercel, Cloudflare, Hetzner VPS, PM2, Docker |
| CI/CD | GitHub Actions (lint, build, test) |
| Testing | Jest (unit), Playwright (E2E) |
| Security | Helmet, CORS, DOMPurify, rate limiting, JWT |