LOCA

Your stuff. Your people. Nearby. Neighbors give things away, ask for things, borrow things and offer help.

Sole engineer, architecture to deployment · 2026 · Designed, built and deployed by Alexus Karl Joaquin.

What I built

• pnpm monorepo: React web app, NestJS + Prisma API, shared packages. 34-table schema, 18 migrations, seeded dev database that ships its own PostgreSQL.
• Authentication end to end: email + password with verification and reset, Google and Apple through Firebase, cookie sessions for the web and token sessions for the native app, rate-limited and CSRF-checked by origin.
• Real domain logic: posts (give / ask / borrow / help), offers and acceptance, borrowing with two-sided handoff confirmation and returns, messaging with unread state and system notes, saved searches and a rules-based matching engine.
• Live feed over server-sent events with heartbeats, "what's new nearby" push notifications on local time slots, and message moderation in English and Tagalog plus OpenAI's moderation endpoint.
• Production hardening: CSP, HSTS, X-Frame-Options, per-client rate limits behind one proxy hop, media retention sweeps, 17 end-to-end test suites run against the local database.
• Deployed on Railway: Caddy serves the static web app and proxies /api to a private API over the internal network; Postgres and object storage never get a public address.

Skills demonstrated

• React
• TypeScript
• Vite
• pnpm monorepo architecture
• NestJS
• Prisma ORM & migrations
• PostgreSQL 18
• Capacitor iOS
• Firebase sign-in (Google / Apple)
• JWT access tokens & cookie sessions
• Rate limiting & origin (CSRF) checks
• CSP / HSTS security headers
• Server-Sent Events live feed
• APNs push notifications
• S3-compatible object storage
• Apple MapKit & OpenStreetMap
• OpenAI moderation
• Resend transactional email
• End-to-end testing (17 suites)
• Docker + Caddy reverse proxy
• Railway private networking
• OpenAPI / Swagger docs

Stack

Screens

More

All projects · Experience · LinkedIn · GitHub