← projects
$ Chessfut
Turns a Chess.com username into a FIFA Ultimate Team style player card, complete with OVR rating and attributes.
- →Built a scoring engine that converts Chess.com public API stats into an OVR rating with six attributes (PAC/SHO/PAS/DRI/DEF/PHY), a position, and badges inspired by GitFut, a similar concept built around GitHub profiles.
- →Backend written in Go following hexagonal architecture (ports & adapters), with PostgreSQL and Redis, integrating directly with the Chess.com public API; frontend built with Next.js App Router.
- →Anchored scoring to verified FIDE rating when available, blended with Chess.com performance titled players with zero recorded games get a real FIDE derived score instead of being floored to zero, discounted for being unproven on the platform rather than granted in full, so activity is always rewarded over an unproven title alone.
- →Hardened the scoring engine against bad input: unrealistic self reported FIDE ratings (above the real world record) are discarded rather than clamped, and accounts with zero games played are floored so an empty profile can never outscore an active player with a real track record.
- →Added IP based rate limiting with an automatic 24 hour ban for repeat offenders, username format validation to reject scanner noise before it ever reaches the upstream API budget, constant time admin key comparison to prevent timing attacks, upper bounds on pagination parameters to close a DoS vector, and server side only error logging so internal errors never leak to the client.
- →Diagnosed and fixed a proxy chain IP spoofing/collision bug where server side rendered requests were all attributed to a single internal address, which could have banned every real visitor at once resolved by forwarding the originating client IP through the SSR hop and parsing the X-Forwarded-For chain from the trusted end inward, skipping internal hops.
- →Set up CI (lint, vet, build, test with coverage for Go; lint, typecheck, test, build for Next.js) and a two way isolated SSH deploy pipeline a command restricted deploy key for GitHub Actions to trigger the server, and a separate read only deploy key for the server to pull the repository.
- →Locked down docker-compose so no service (Postgres, Redis, backend, frontend) exposes a port to the host everything routes through an existing nginx proxy container over the internal Docker network, with automatic Let's Encrypt certificates.
GoNext.jsHexagonal ArchitecturePostgreSQLRedisDockerCI/CDSecurity