Realtime Platform Systems Architecture & Engineering
RTMS
A realtime messaging & management platform
Digital media installations have to talk to web apps, mobile apps and backend services: reliably, securely and without a one-off integration for every installation.
I designed and built RTMS as the layer between them. Its central idea is that the session, not the socket, is the unit of work. Connections drop and come back, but a session keeps its members, its policy and its audit trail.
Node.js Fastify WebSockets REST JWT RBAC Docker
- ConstraintLong-lived connections over networks that drop without warning.
- ConstraintMany tenants on one platform, strictly isolated from each other.
- ConstraintEvery message traceable when something goes wrong in production.
System model
Select a component to see what it is responsible for.
Session manager Owns the session lifecycle: create, join, resume, leave, expire. Membership outlives individual connections.
Session lifecycle
-
Session first, connection second
Reconnects resume an existing session instead of creating a new one, so a dropped network link never orphans an installation.
-
Validate at the boundary
Every REST body and WebSocket message is checked against a schema before it reaches business logic, so malformed input fails early and predictably.
-
Backpressure at the edge
The WebSocket pipeline handles reconnection and backpressure, so one slow consumer can't stall everyone else.
-
Security proven by failing tests
JWT authentication, role-based access and tenant isolation, with negative tests that deliberately try to cross every boundary.
-
Observable from day one
Structured Pino logs, Prometheus metrics and Grafana dashboards, with correlation IDs that follow each message from end to end.
-
Same container everywhere
The platform ships as a Docker image, so local, test and production environments run the same build.
Verified results
- p95 latencyMeasured p95 latency within its target.
- Zero ghost sessionsDisconnect, reconnect and expiry scenarios leave no orphaned sessions behind.
- Negative security testsAttempts to cross authentication, role and tenant boundaries are tested and rejected.
- Unit + E2EAutomated unit and end-to-end test suites.