DEV Community

Shivam Kumar
Shivam Kumar

Posted on

Reading a "production-grade" CRM repo honestly: what the code actually shows

#typescript #node #docker

VisionQuantech's CRM platform describes itself as a "production-grade multi-tenant CRM" — and then, unusually, its README immediately scopes the claim: "not as a claim that every enterprise capability is already complete or production-certified." I read the backend, the compose stack, and the workflow engine to see what's real. Here's the honest code tour.

The stack: six containers, all healthchecked

infrastructure/docker/docker-compose.yml is the most concrete file in the repo:

  • PostgreSQL 15 (Alpine) — init scripts mounted (01-schema.sql, 02-seed.sql), persistent volume, pg_isready healthcheck.
  • Redis 7 (Alpine) — append-only persistence, redis-cli ping healthcheck.
  • Kafka via RedPanda (dev-container mode) — Kafka-compatible streaming without ZooKeeper-era ops weight.
  • MinIO — S3-compatible object storage.
  • Elasticsearch 8.11 — single-node, for the customer-360 search layer.

Plus Kubernetes manifests (infrastructure/kubernetes/), ci-cd.yml + deploy.yml in .github/workflows/, deploy.ps1 / deploy-backend.ps1 / deploy-frontend.ps1, a Unix install.sh, and backend/scripts/smoke.js for post-deploy health checks. The infrastructure thinking is genuinely done — this is the part of a CRM that's expensive to retrofit later, and it's wired at foundation stage.

The API: security-first, demo-honest

backend/src/index.js sets the security posture before any route:

app.use(helmet());
app.use(cors({
  origin: CORS_ORIGINS.length > 0 ? CORS_ORIGINS : false,  // allow-list, never "*"
}));
app.use(express.json({ limit: '256kb' }));
Enter fullscreen mode Exit fullscreen mode

Auth is an API key on every non-public endpoint via the x-api-key header, and the key-resolution code has the property I wish more projects had:

if (!API_KEY) {
  if (NODE_ENV === 'production') {
    console.error('[fatal] API_KEY is not set and NODE_ENV=production. Refusing to boot.');
    process.exit(1);
  }
  // ... demo key with a loud warning
}
Enter fullscreen mode Exit fullscreen mode

No hardcoded secrets, Joi validation on payloads, SEED_DEMO for local bootstrapping. And then the honest header comment: the store is in-memory (let contacts = []) — "Production deployments should swap the in-memory store for Postgres (DATABASE_URL) — see README." A demo-grade API wearing its status openly, with the swap path documented. I'd rather read this than a repo that pretends.

The workflow engine: typed triggers, conditions, actions

backend/services/workflow.ts defines the automation layer as interfaces:

trigger_type: 'lead_created' | 'deal_stage_changed' | 'contact_updated' | 'scheduled' | 'manual';
Enter fullscreen mode Exit fullscreen mode

Conditions support equals / not_equals / contains / greater_than / less_than / in / not_in with AND/OR combinators; actions are send_email | create_task | update_field | send_notification | webhook | wait, each with its own config shape and optional delay_minutes. The service imports pg, a Redis manager, a Kafka manager, and an email service — the engine is designed to evaluate against Postgres state and dispatch through queues. contact_service.ts and email_service.ts sit alongside it.

Running it 

git clone https://github.com/Shivay00001/crm-platform.git
cp .env.example .env   # set a real API_KEY for anything beyond local demo
docker compose -f infrastructure/docker/docker-compose.yml up
# backend boots on :8004 — GET /health is public, everything else needs x-api-key
node backend/scripts/smoke.js
Enter fullscreen mode Exit fullscreen mode

Set NODE_ENV=production and the boot checks enforce the API key; wire DATABASE_URL to Postgres to replace the demo store. DEPLOYMENT.md + the K8s manifests cover the cluster path.

Verdict

Working foundation, partial product. Real: the six-service data plane with healthchecks, the security defaults (no production boot without a key, CORS allow-list, Helmet, Joi), the typed workflow engine design, the deployment automation. Demo-grade: the contacts store, explicitly marked. Roadmap: the full capability list (pipelines UI, lead scoring, analytics/funnels, RBAC enforcement across surfaces). The README's own production-readiness assessment is the first thing to read — it tells you the author knows exactly what's left. Note the custom VisionQuantech license (commercial license available) — read LICENSE before building a business on it.

Repo: https://github.com/Shivay00001/crm-platform

Top comments (0)