🌟 MyZubster: A Complete Decentralized Marketplace with Monero Payments

🌟 MyZubster: A Complete Decentralized Marketplace with Monero Payments
Introduction and Vision

Hello everyone! I want to share with you my journey of building a complete decentralized marketplace called MyZubster. This is a project that I'm really passionate about because it combines privacy-focused cryptocurrency payments with modern web technologies, all running on a single VPS. The core idea was to create a platform where people can buy and sell items using Monero (XMR) as the primary currency, ensuring privacy and security for all transactions.

The system is built on three main components that work together seamlessly. First, there's the Gateway, which handles all the Monero payment processing and uses Node.js with MongoDB as its database. Second, we have the Marketplace API, which manages all the business logic like product listings, user accounts, and orders, using Node.js with SQLite. Third, there's the Frontend, which is a React application served through Nginx that provides a beautiful and intuitive user interface.

But I didn't stop there. I also integrated some really cool additional features. There's a Security Bot that automatically scans for vulnerabilities using Kali Linux tools and analyzes the results with DeepSeek AI. I also started working on NFT support using Rust on Tari, which is Monero's sidechain for digital assets.
The Technology Stack

Let me walk you through the technologies I chose for this project. For the programming languages, I used JavaScript with Node.js for the backend APIs, Python for the security automation scripts, and Rust for the blockchain-based NFT implementation. On the frontend, I used React 18 with Vite 4 for fast development and optimized production builds.

For databases, I made some interesting choices. The Gateway uses MongoDB 7 because it handles transactional payment data really well, especially with time-series data. The Marketplace uses SQLite 3, which is lightweight and perfect for a single-server deployment since it doesn't require any additional configuration or running database server.

For the infrastructure, Docker and Docker Compose are the backbone of the deployment strategy. They ensure that everything runs consistently across different environments and make the system reproducible and easy to manage. Nginx serves as both the web server for the frontend and a reverse proxy for the API requests.

The security infrastructure is quite comprehensive. I'm using Kali Linux tools like nmap and nikto for vulnerability scanning, DeepSeek AI running on Ollama for intelligent security analysis, and UFW for firewall management and IP blocking.
Step 1: Gateway Configuration in Detail

Let me start with the Gateway configuration because this is really the heart of the payment system. I created a Dockerfile using a multi-stage build approach, which is really important for production deployments. The first stage is the builder, where I install all the dependencies and prepare the application. The second stage creates the production environment with a non-root user for security, copies only what's necessary from the builder stage, and sets up the runtime environment.

The reason I used a non-root user is important for security. If someone manages to compromise the container, they won't have root access to the host system. I also used npm ci instead of npm install to ensure reproducible builds, and I cleaned the npm cache to reduce the final image size.

For the Docker Compose configuration, I orchestrated the MongoDB database and the Gateway service together. The MongoDB container uses environment variables for authentication and mounts a persistent volume so the data survives container restarts. I added a health check that runs every 30 seconds using mongosh to ping the database, and the Gateway waits for MongoDB to be healthy before starting.

I mapped the internal port 3000 of the Gateway to external port 3001 to avoid conflicts with other services that might be running on the VPS. The MongoDB internal port 27017 is mapped to 27018 externally. I also set up volumes for persistent data storage and separate volumes for logs to make debugging easier.

The environment variables are managed through a .env file that's excluded from version control. This file contains all the sensitive information like database passwords, Monero wallet credentials, JWT secrets, and API keys. I used default values with fallbacks for non-sensitive variables to make the system more robust.

When I launched the Gateway with docker compose up -d --build, Docker built the image, started both containers, and connected them through a bridge network. I verified everything was working by curling the health endpoint, which returned a status OK response.
Step 2: Connecting the Marketplace

The Marketplace is a separate Node.js application that serves as the business logic layer. It connects to the Gateway through REST API calls to process payments and manage orders. I configured it with its own environment variables, including the Gateway API URL and authentication token.

The Marketplace uses SQLite as its database, which is perfect for this use case because it's lightweight, requires no configuration, and works well for moderate data volumes. I set the database storage path to a data directory within the application folder.

When I launched the Marketplace with node server.js &, it started in the background and immediately began listening on port 4000. I verified the integration by checking both the health endpoint and the gateway status endpoint. The marketplace successfully reported that it was connected to the gateway, confirming that the REST API communication was working properly.

This integration is smooth because both services use Node.js, they communicate over localhost which eliminates network latency, and the REST API provides a clear contract between the services. The health checks give immediate validation that everything is working as expected.
Step 3: Deploying the Frontend

For the frontend, I built a React application using Vite for fast development and optimized builds. When I ran npm run build, Vite compiled all the React components into optimized JavaScript, bundled the CSS and assets, created minified files for faster loading, and generated source maps for debugging.

The Nginx configuration was crucial for serving the frontend properly. I set up a server block that listens on port 80 and serves the static files from /var/www/myzubster-frontend. The key part is the location block that handles Single Page Application routing. I used the try_files directive to first look for the requested file, then look for the directory, and finally fall back to index.html. This allows React Router to handle client-side routing properly.

For the API requests, I set up a proxy location block that forwards any request starting with /api/ to the Gateway running on http://localhost:3001/api/. I configured the proxy to preserve the HTTP version, maintain proper host headers, and prevent caching of API responses.

When I deployed the built files with sudo cp -r dist/* /var/www/myzubster-frontend/ and restarted Nginx, the frontend became accessible at the VPS IP address. I verified with curl -I that the server was responding with HTTP 200 OK.
Step 4: Security Bot Integration

The Security Bot is a Python script that runs automated vulnerability scanning and analysis. It uses nmap to scan the gateway port and identify any open services or potential issues. It also uses nikto for comprehensive web vulnerability scanning, checking for common security issues like outdated software, misconfigurations, and potential exploits.

After running the scans, the bot sends the results to DeepSeek AI, which is running locally through Ollama. The AI analyzes the scan results and identifies any security concerns. If the AI detects suspicious or malicious activity, the bot automatically extracts IP addresses from the scan results and blocks them using the UFW firewall.

The bot is scheduled to run automatically through cron jobs. I set up hourly scans for regular monitoring, 15-minute interval quick scans for immediate threat detection, and weekly comprehensive audits for thorough security assessment. All the results are logged to separate files for auditing and analysis.

This automated security approach is really powerful because it reduces response time to potential threats significantly. The AI analysis provides intelligent insights that would be time-consuming to get manually, and the automatic IP blocking provides immediate protection against malicious actors.
The Results and What I Learned

After completing the deployment, all services were running successfully. The Gateway was responding with status OK, the Marketplace was healthy and connected to the Gateway, the Frontend was serving pages correctly, both MongoDB and SQLite databases were connected, and the Security Bot was running hourly as scheduled.

The system architecture shows a clean separation of concerns. The Frontend serves the user interface and proxies API requests to the Gateway. The Gateway handles payment processing and connects to MongoDB for transaction data. The Marketplace manages business logic and connects to SQLite for operational data. All services connect to a Monero public node for blockchain interaction, and the Security Bot runs continuously monitoring everything.

I learned several valuable lessons from this project. First, Docker really simplifies deployment. Containerizing the gateway made the entire process reproducible, scalable, and much easier to manage than traditional deployment methods. The multi-stage builds significantly reduced the image size, and the non-root users added an extra layer of security.

Second, environment variables are absolutely critical. Separating configuration from code is essential for both security and flexibility. I could easily switch between different environments just by changing the .env file, without touching the code.

Third, Monero payment integration is actually quite straightforward. Using a public RPC node worked well for testing, and the REST API communication between services was seamless. The wallet recovery process was painless because I saved the seed phrase on a physical USB stick.

Fourth, Nginx is a powerful ally. A single configuration file handled both serving static files and proxying API requests, keeping everything clean and efficient. The try_files directive made SPA routing work perfectly.

Fifth, security is definitely a long-term investment. The automated Security Bot with DeepSeek AI significantly reduced response time to potential threats. The combination of regular scanning, AI-powered analysis, and automated response creates a robust security posture.
Future Plans and How You Can Contribute

Looking ahead, I have several exciting plans for MyZubster. I want to add HTTPS with Certbot for secure connections, deploy the mobile app to the Google Play Store, integrate NFC payments for physical interactions, implement DAO governance for community decisions, complete a comprehensive security audit with third-party tools, and add more NFT functionality for real-world asset tokenization.

If you're interested in blockchain, privacy-first payments, or decentralized markets, I'd love to have you contribute. There are several areas where help is needed. The frontend needs improvements to the admin dashboard, we need more comprehensive testing with webhook integration tests, the documentation could be expanded with tutorials for new users, and security penetration testing would be valuable.

The code is all available on GitHub. The Gateway repository is DanielIoni-creator/MyZubsterGateway, the Marketplace is DanielIoni-creator/MyZubster-Marketplace, the Frontend is DanielIoni-creator/myzubster-frontend, the Mobile App is DanielIoni-creator/MyZubster-App, and the NFT Template is DanielIoni-creator/tari-nft-template.

I've documented the entire process on DEV.to and I'm active on Twitter at @myzubster, LinkedIn as Daniel Ioni, and GitHub as DanielIoni-creator. I'd be really happy to connect with anyone interested in this project.
Quick Reference for All Commands

For anyone who wants to replicate this setup, here are all the key commands I used. To deploy the Gateway, navigate to the gateway directory and run docker compose up -d --build then check the status with docker compose ps. To deploy the Marketplace, navigate to the marketplace directory, run npm install, and start the server with node server.js &. To deploy the Frontend, build it with npm run build, copy the dist files to the Nginx serving directory, and restart Nginx.

To verify everything is working, check the marketplace gateway status with curl http://localhost:4000/api/gateway/status and access the frontend at your VPS IP address. The security bot runs automatically through cron jobs, and you can check the logs in /var/log/security_bot.log.
Final Thoughts

Building MyZubster has been an incredible journey. It demonstrates that you can create a complete, privacy-focused e-commerce platform on affordable infrastructure. The combination of Monero payments, modern web technologies, and automated security monitoring creates a robust system that respects user privacy while remaining practical for real-world use.

I built this with love for Monero, Tari, and the open-source community. I hope this documentation inspires others to explore decentralized commerce and contribute to the ecosystem. The project is open for contributions, and I'm excited to see where the community takes it.

Thank you for reading about my journey. If you have any questions or want to get involved, please don't hesitate to reach out. Let's build a more private and decentralized future together!