Front end: React and TypeScript
React lets us build interfaces from reusable components and has one of the largest developer communities, so the software never depends on a niche skill. TypeScript checks the shape of data at build time, from the API response to the button that displays it — a whole class of bugs never reaches users. We pair them with Vite for fast builds and Tailwind CSS for consistent, maintainable styling.
Back end: Node.js and Express
Using JavaScript and TypeScript on both sides means one team can work across the whole product, and types and validation rules can be shared. Express keeps the API layer small and explicit: every route declares the permission it needs.
Real-time: Socket.IO and WebRTC
When screens must update the moment something changes, we use Socket.IO for a persistent connection rather than polling. For live video, such as CR Cafe’s remote screen view, we use WebRTC so the stream goes peer to peer and the server only relays signalling. We wrote up the approach in building real-time station control.
Data: PostgreSQL
PostgreSQL gives us relational data with real constraints, transactions and mature tooling. Schema changes are versioned migrations applied on release, and we check for drift between the code’s models and the live database, so every environment matches.
Desktop: Electron
When software has to run on a Windows PC — like CR Cafe’s lock-screen agent and Wake-on-LAN relay — we use Electron with an auto-update channel. It lets the same team ship desktop software alongside the web platform. See building a lock-screen agent with Electron for what that involves in practice.
Mobile and devices: React Native and ESP32
For mobile apps we use React Native with Expo, reusing the team’s React and TypeScript skills. For connected hardware, such as CR Cafe’s wall-mounted session displays, we write firmware for ESP32 microcontrollers that talk to the same backend.
Deployment and infrastructure
- GitHub Actions pipelines that build and deploy on every push to the main branch
- Linux servers with nginx and HTTPS, and a process manager for zero-downtime reloads
- Desktop release feeds for self-updating installers
- Release announcements to the team, generated from the changelog
Security built into the stack
HttpOnly session cookies, bcrypt password hashing, rate limiting, security headers and server-side permission checks are part of the default setup, not add-ons. The details are on our security page.
Scalability
We scale the boring way first: good indexes, stateless API processes, a single source of truth in the database, and features that are data rather than code. That covers most businesses for a long time, without the cost of infrastructure they don’t need yet.