Cesar Petrescu

Lab · Apps

  • In development
  • Release Candidate

Gospod

Romanian local-producer discovery with geospatial search, moderated publishing, and release-gated operations

A mobile-first discovery platform for Romanian local food producers. Buyers search by where they can receive a product, inspect approved availability and delivery terms, and contact producers directly. Producer drafts and exact locations remain private until reviewed. The system is a conditional release candidate for a controlled pilot, not a claim of nationwide production deployment.

Status: Conditional release candidate · controlled pilot

  • Go
  • Next.js
  • React
  • TypeScript
  • PostgreSQL
  • PostGIS
  • Keycloak
  • Nginx
  • Transactional Outbox
  • ClamAV
  • pgBackRest
  • Restic

Conditional release candidate · controlled Romanian pilot

Private producer work becomes a reviewed public discovery surface

Trace public search, producer onboarding, moderated publication, or media processing. Private locations, drafts, originals, and operational state remain behind explicit ownership and approval boundaries.

A buyer searches by where a product can be received

Destination, category, availability, pickup, and delivery constraints reach the Go API through the single Nginx edge. PostgreSQL/PostGIS returns approved producer and product projections without exposing private drafts, exact locations, rejected media, or moderation notes.

Search model
Destination, collection point, pickup, and home-delivery eligibility are first-class filters.
Public boundary
Only approved projections enter discovery.
Marketplace boundary
Gospod does not own carts, orders, reservations, payments, invoices, couriers, or delivery.
Contact model
Buyers contact producers directly by phone or WhatsApp.
  • Public requestBuyer → Nginx → Next.js web → Go API / OIDC BFF
  • Geospatial queryGo API / OIDC BFF → PostgreSQL + PostGIS

A producer application remains private until deliberate submission

The producer saves resumable drafts, supplies a private address or movable map pin, and submits idempotently. Broad OIDC roles are combined with database-backed ownership checks so one producer cannot edit another producer’s application.

Draft lifecycle
Save, submit, resubmit, archive, and optimistic-concurrency transitions are explicit.
Location privacy
Exact addresses and unapproved pins remain private.
Authorization
Role checks are combined with record ownership.
Durability
Application state and outbox work commit before background processing.
  • Authenticated workspaceProducer → Nginx → Next.js web → Go API / OIDC BFF → Keycloak
  • Application stateGo API / OIDC BFF → PostgreSQL + PostGIS
  • Private uploadsGo API / OIDC BFF → Private BlobStore
  • Durable handoffGo API / OIDC BFF → Jobs + transactional outbox → Go worker

Moderation publishes reviewed projections rather than mutable drafts

A moderator claims an application, producer revision, product revision, or media item before deciding. The system records diffs and reasons, then approves, requests changes, rejects, suspends, or reactivates without exposing unapproved content.

Claim before decision
Review ownership and optimistic concurrency prevent silent competing decisions.
Reasoned state
Every decision has a typed state, reason, actor, and timestamp.
Projection rule
Approval creates the public view; drafts stay private.
Audit
Moderation and exports retain request and actor evidence.
  • Moderator identityModerator / admin → Nginx → Next.js web → Go API / OIDC BFF → Keycloak
  • Claim and decisionGo API / OIDC BFF → PostgreSQL + PostGIS
  • Publication workGo API / OIDC BFF → Jobs + transactional outbox → Go worker → PostgreSQL + PostGIS

Untrusted uploads are transformed before public delivery

Original media enters private storage. A worker validates type and limits, decodes and re-encodes images, removes metadata, and creates immutable variants. Documents remain unavailable unless the ClamAV profile and its feature coupling are active.

Private originals
Raw uploads are never served as public assets.
Image sanitation
Decode/re-encode strips metadata and rejects malformed payloads.
Document fail-closed rule
Unavailable scanning means unavailable document upload.
Async recovery
Attempts, errors, dead-letter state, and stale-claim recovery stay durable.
  • Private ingestProducer → Nginx → Next.js web → Go API / OIDC BFF → Private BlobStore
  • Durable processingGo API / OIDC BFF → Jobs + transactional outbox → Go worker
  • Document scanGo worker → ClamAV profile
  • Immutable variantsGo worker → Private BlobStore
  • Variant metadataGo worker → PostgreSQL + PostGIS
  • Browser / authenticated request
  • Domain / background work
  • Durable state / private media
PeoplePeopleEdge and identityEdge and identityApplication coreApplication coreData and operationsData and operationsBuyersearch + direct contactBuyer — search + direct contactProducerprivate drafts + availabilityProducer — private drafts + availabilityModerator / adminreview + governanceModerator / admin — review + governanceNginxonly published host portNginx — only published host portNext.js webpublic + workspacesNext.js web — public + workspacesKeycloakOIDC Code + PKCEKeycloak — OIDC Code + PKCEGo API / OIDC BFFauthz + domain transactionsGo API / OIDC BFF — authz + domain transactionsGo workerjobs + media + exportsGo worker — jobs + media + exportsJobs + transactional outboxretry + dead letterJobs + transactional outbox — retry + dead letterPostgreSQL + PostGIScatalog + geo + auditPostgreSQL + PostGIS — catalog + geo + auditPrivate BlobStoreoriginals + variantsPrivate BlobStore — originals + variantsClamAV profilefail-closed documentsClamAV profile — fail-closed documentspgBackRest + Resticbackup + restorepgBackRest + Restic — backup + restore

Tap a service to see what it calls and what calls it.

People

Edge and identity

Application core

Data and operations

ONE-PORT EDGE

Only Nginx publishes a host port

Web, API, identity, worker, database, and storage remain on private networks.

PUBLIC PROJECTION

Public data is approved data

Pending drafts, exact private locations, internal notes, and unapproved media cannot enter public responses.

OWNERSHIP

A role is not record ownership

Producer mutations require both authenticated role context and database-backed ownership.

ASYNC SAFETY

Commit before background work

Jobs and outbox records become retryable only after domain state is durable.

MEDIA SAFETY

Originals are never public assets

Images are decoded and re-encoded; document handling fails closed without scanning.

RELEASE HONESTY

Controlled-pilot release candidate

Substantial tests and operations tooling do not replace the remaining live-system, staging, restore, immutable-image, DNS/TLS, and legal gates.

Why it exists

Useful local-food discovery depends on destination, pickup, delivery, availability, locality privacy, producer trust, and direct contact—not only a generic product grid.

Gospod treats private onboarding and public discovery as one governed system with durable moderation and operations evidence.

Use cases

  • Find products deliverable or collectable in a chosen Romanian locality
  • Let producers maintain private drafts without self-publishing unreviewed content
  • Moderate applications and revisions with visible decisions and audit
  • Operate a controlled pilot with repeatable deployment and recovery

Capabilities

Geospatial discovery
PostgreSQL/PostGIS destination and locality search.
Governed publication
approved projections are separate from mutable drafts.
Durable workflows
jobs and outbox with retry, dead-letter, and stale-claim recovery.
Safe media
private originals, sanitation, immutable variants, and fail-closed documents.
Identity
OIDC Code + PKCE, opaque hashed sessions, CSRF, trusted origins, roles, and ownership.
Release evidence
API parity, fuzz/property/browser/system tests and explicit production gates.

Components

Public discovery

  • Destination-based product and producer search
  • Availability, pickup, delivery, phone, and WhatsApp actions
  • Approved SSR metadata, robots, and sitemap surfaces

Producer workspace

  • Resumable private applications and revisions
  • Delivery settings and collection-point participation
  • Ownership checks and optimistic concurrency

Moderation

  • Claim-before-decision queues
  • Diffs, reason templates, approval/change/reject/suspend/reactivate
  • Audited exports and governance surfaces

Durable core

  • Go API, worker, and migrations
  • PostgreSQL/PostGIS domain and geospatial state
  • Private BlobStore and transactional outbox

Release operations

  • One-port topology checks and hardened Compose
  • Optional ClamAV, OTel/Grafana, pgBackRest, and Restic profiles
  • Documented staging, backup/restore, digest, DNS/TLS, and legal gates

Integrations

Identity and authorization

  • Keycloak OIDC Code + PKCE
  • Opaque hashed application sessions
  • Role, ownership, CSRF, and trusted-origin enforcement

Geospatial data

  • PostgreSQL/PostGIS with pg_trgm, unaccent, and pgcrypto
  • Destination-oriented discovery
  • Versioned migrations and API/OpenAPI parity

Media and documents

  • Private BlobStore originals
  • Decode/re-encode and metadata removal
  • ClamAV-coupled fail-closed document profile

Operations

  • Nginx one-port edge and hardened Compose
  • Optional OTel/Grafana
  • pgBackRest and Restic backup/restore workflows

Outcome

Gospod is presented honestly as a conditional release candidate for a controlled pilot: a governed Romanian discovery platform with geospatial search, private producer workflows, moderated publication, safe media processing, durable background work, and explicit operational release gates.