trafficwar
trafficwar is a multi-tenant, self-hostable observability tool that turns a live HTTP API's real traffic into a real-time "space war" game visualization. You run a tiny dependency-free pass-through proxy in front of any API — zero app-code changes, just repoint the base URL — and its actual traffic plays out on a dashboard where each client session is a fighter ship, each endpoint an enemy station, and each request a shot fired. You can click any ship and replay that client's exact journey step-by-step, including wait and service time at every hop. It's privacy-first: only anonymized, opaque events ever leave the user's network. The system is three decoupled parts over one small event contract: a standalone zero-dependency Node reverse proxy (published as its own npm package), a Next.js 16 SaaS app handling auth/projects/ingest/dashboards, and a browser Canvas visualizer driven by a pure reducer. Live dashboards are powered purely by Postgres LISTEN/NOTIFY fanned out to browsers over Server-Sent Events — no Redis, no message broker, no sticky sessions — so it scales horizontally while staying self-hostable.
Overview
A self-hostable, multi-tenant SaaS that visualizes any API's live traffic as a real-time space battle — drop a proxy in front of your API, no SDK, no code changes.
Key Challenges
- Achieving reliable realtime at scale using only Postgres LISTEN/NOTIFY + SSE — including the transaction-pooler pitfall that silently breaks LISTEN, and keeping SSE alive through reverse proxies.
- Designing a minimal generic event contract rich enough to derive per-client journeys, dynamic station discovery, and idle-expiry client-side rather than shipping heavy per-hop data over the wire.
- Building a truly non-intrusive proxy: verbatim forwarding, SSRF safety, and a fail-open hot path guaranteeing observability never degrades the user's real traffic.
- Deploying a stateful, long-running Node app (not serverless) with end-to-end multi-tenant security and bounded data growth (rolling event window, LRU actor map).
Key Achievements
- Zero-instrumentation onboarding — capture real traffic with no SDK and no code changes; users just repoint an API base URL to the proxy (~5-minute setup).
- Realtime multi-tenant streaming with no extra infrastructure — live dashboards powered purely by Postgres LISTEN/NOTIFY over SSE, horizontally scalable without Redis or a message broker.
- Per-client journey replay — reconstructs and replays each client's step-by-step path (wait + service time per hop) entirely client-side from a minimal event wire.
- SSRF-safe, fail-open proxy — upstream origin locked to an allowlist, never follows cross-host redirects, and event emission is batched so it can never delay or alter proxied traffic.
- Privacy & tenant isolation by design — client identity is salted-hashed to an opaque integer, request bodies are never inspected, every query is scoped to its owner, and API keys are stored hashed and shown once.
- Rich product surface — live RPS/latency/error metrics, endpoint & actor leaderboards, timeline analytics, email alert rules, public read-only share links, "boss wave" mechanics, swappable visualizer skins, and audio cues.