Case study · Privacy first messaging app

A privacy first messenger, shipped across six backend services

GuturGu is a cross platform messaging app with chat, calls and stories. I built the infrastructure from scratch, moved it to a Coolify managed AWS Lightsail stack, and am migrating the client to a typed, audited Flutter architecture.

Backend services: gateway, auth, user, chat, call, story: 6
Docker Compose monorepo deploy: 1
Phase security audit for the Flutter migration: 4
Encrypted message design: E2E

Role: Backend, infrastructure and Flutter leadVisit live site

Node.js
PostgreSQL
Redis
Docker Compose
Coolify
AWS Lightsail
Cloudflare R2
LiveKit
Flutter

Image slotArchitecture diagram of the six services behind the API gateway

Six services, one gateway, one compose file.

The challenge: in a messenger, small bugs are leaks

A privacy product fails in quiet ways: a key serialized into a log, a token in the wrong place, a service exposed by mistake.

As the sole engineer I also had to own hosting, cost and deployment, not just features.

“In a messenger, a serialization bug is a security bug.”
Dev notes

Image slotDiagram of where key material is created, stored and sent

Mapping where sensitive data can leak was step one.

Goals and success metrics

Own the stack, control the bill, protect the keys.

Deploy all six services repeatably from a single compose setup
Keep media, calling and email on dedicated providers
Predictable hosting cost with room to scale
Client models that cannot accidentally serialize key material

User and research

The user wants private chat that feels as fast as the big apps. The developer research question was how much control to keep.

Compared managed platforms with self hosting on cost, control and data ownership
Chose dedicated providers where specialists win: Cloudflare R2 for media, LiveKit Cloud for calls
Audited client models for anything that carries key material

Process and approach

Three phases, each leaving the system in a working state.

Phase 1: a DigitalOcean droplet on Ubuntu 24.04 with PM2, Nginx, SSL, PostgreSQL and Redis
Phase 2: a Docker Compose monorepo deployed through Coolify on AWS Lightsail
Phase 3: a Flutter migration with Dio, Retrofit and Freezed, gated by a four phase security audit
Tight, file scoped AI prompts for each service to keep changes reviewable and costs low

Solution

An API gateway fronts auth, user, chat, call and story services. Media lives on Cloudflare R2 and calling runs on LiveKit Cloud.

A landing page captures early interest through a Google Apps Script subscription flow, with Brevo for email marketing and Formspree for forms.

Image slotCoolify dashboard showing the six deployed services

All six services running under Coolify on AWS Lightsail.

Technical details

Where the real work and the real bugs were.

Inter service DNS and environment variables took the most debugging during the Coolify move
Each service resolves its neighbours by internal name, with per service env files
UserKeyBundle needs manual Freezed handling so it can never be serialized by accident
Retrofit and Dio give typed, centralised network calls in the Flutter client
Claude Code runs on API billing with effort and file scoping limits to control spend

Results

The full six service backend is deployed on Coolify and the migration path is mapped, with the security audit defined before any client code moves.

Services deployed: 6
Infra layers: app, media, calling: 3
Audit phases planned: 4
Compose file to ship it all: 1

“Boring infrastructure is a privacy feature.”
Dev notes

Lessons

Most migration pain is networking and env vars, not code.
Give key types special handling from day one.
Scope AI assisted work tightly, one service at a time.
Building the infra yourself shows what managed platforms hide.

Next steps

Finish the Flutter migration and run the four phase audit
Server rendered landing page with full metadata and Open Graph tags
Monitoring, alerting and automated backups
Closed beta with a feedback loop