DeraEdge

DeraEdge is a private financial intelligence & proprietary trading firm's platform: a public marketing site, a paid Trading Academy with a student portal, and an internal executive command center for admins — backed by a single Go API.

This is a from-scratch monorepo with three independently-built, independently-verified applications:

App	What it is	Stack	Port (dev)
web	Public site + Trading Academy + student portal	Next.js 16.3.0, React 19.2.8, TypeScript, Tailwind CSS 4	3000
admin	Internal executive command center	Next.js 16.3.0, React 19.2.8, TypeScript, Tailwind CSS 4	3001
backend	Shared API for both frontends	Go 1.22.2, chi, pgx/pgxpool, Postgres	8080

admin is never linked from web's public navigation — it is a separate app on a separate subdomain, reachable only if you know the URL and can authenticate as an admin.

Architecture at a glance

Both frontends are thin clients: all business logic, validation, entitlement checks, and role enforcement live in the Go backend. web and admin talk to the backend over HTTP with credentialed (credentials: "include") requests, sharing the de_session cookie via a common cookie domain in production. See ARCHITECTURE.md for the full request-flow walkthrough and the reasoning behind the key technical choices (opaque sessions vs JWT, inline Stripe price_data, hand-written SQL repositories instead of an ORM).

Quickstart

1. Backend (start this first)

cd backend

# Postgres via Docker
docker run --rm -d --name deraedge-pg \
  -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=deraedge \
  -p 5433:5432 postgres:16-alpine

cp .env.example .env   # edit as needed; the Docker command above matches the defaults

# Migrate
DATABASE_URL="postgres://postgres:postgres@localhost:5433/deraedge?sslmode=disable" \
  GOTOOLCHAIN=local /usr/lib/go-1.22/bin/go run ./cmd/migrate up

# Seed (3 Academy tiers + curricula, 1 published research article, 1 admin user)
DATABASE_URL="postgres://postgres:postgres@localhost:5433/deraedge?sslmode=disable" \
APP_ENV=development ADMIN_EMAIL=admin@deraedge.com ADMIN_PASSWORD=ChangeMe123! \
  GOTOOLCHAIN=local /usr/lib/go-1.22/bin/go run ./cmd/seed

# Run
DATABASE_URL="postgres://postgres:postgres@localhost:5433/deraedge?sslmode=disable" \
PORT=8080 APP_ENV=development \
CORS_ALLOWED_ORIGINS="http://localhost:3000,http://localhost:3001" \
ADMIN_EMAIL=admin@deraedge.com ADMIN_PASSWORD=ChangeMe123! \
WEB_BASE_URL="http://localhost:3000" \
  GOTOOLCHAIN=local /usr/lib/go-1.22/bin/go run ./cmd/api

GOTOOLCHAIN=local is required in this environment — the default go on PATH tries to auto-fetch Go 1.23 and hangs without network access to proxy.golang.org. Always invoke Go pinned to the installed 1.22 toolchain at /usr/lib/go-1.22/bin/go. Full detail, including testing commands, is in backend/README.md and the endpoint reference is in backend/API.md.

2. Web (public site + Academy + student portal)

cd web
npm install
cp .env.example .env.local   # NEXT_PUBLIC_API_URL defaults to http://localhost:8080
npm run dev                  # http://localhost:3000

3. Admin (executive command center)

cd admin
npm install
cp .env.example .env.local
npm run dev -- -p 3001       # http://localhost:3001 (avoid colliding with web's 3000)

Log in with the seeded admin user (ADMIN_EMAIL / ADMIN_PASSWORD above).

Each app's own README (web/README.md, admin/README.md, backend/README.md) is the authoritative source for exact run/build/test/lint commands, including test commands as Vitest/Playwright coverage is added.

What's where

• ARCHITECTURE.md — system diagram, how the three apps communicate, a full checkout → webhook → entitlement request-flow walkthrough, and why the key architectural decisions were made.
• ENVIRONMENT.md — every environment variable used across all three apps, grouped by app, with dev/staging/production guidance.
• SECURITY.md — the real security posture: password hashing, session model, CSRF, CORS, rate limiting (and its known limitation), webhook verification, RBAC, audit logging, and honestly-stated gaps.
• DATABASE.md — the full Postgres schema: every table, its purpose, key columns, relationships, and notable constraints.
• AGENTS.md — instructions for engineers and AI agents working in this repo: conventions, how to run everything locally, and explicit rules that must not be violated.
• DEPLOYMENT.md (Vercel for web/admin, Render for backend, Neon for Postgres, Cloudflare DNS, Stripe, Resend) is maintained separately and may not exist yet at the time you're reading this — if missing, treat deployment specifics as pending and do not assume defaults from this document.

Business domain, in brief

• Trading Academy has 3 tiers, seeded with their full curricula: Foundation ($100, 4 weeks, 11 modules), Professional ($200, 6 weeks, 12 modules), Mastery ($500, 10 weeks, 13 modules).
• Roles: public → student (automatic, only via a confirmed Stripe webhook on paid enrollment) → admin (manual only; there is no public admin registration path).
• Design system: light-mode only, no dark mode or theme toggle. Canvas #FFFFFF / #F8FAFC / #F1F5F9, ink #0F172A, indigo #4F46E5 primary, emerald #059669 positive accent, a reserved gold/amber tone for Mastery-tier moments. Fraunces (serif display) + Inter (body/UI) + IBM Plex Mono (data/figures).