Overview / Architecture

System Architecture

How the website, backend, databases, and mobile apps connect end-to-end.

Two different "backends" are in play

The dashboard and the WordPress sites run on your production droplet (161.35.191.47). But the shipping mobile app is hard-coded to call https://hatch-social.cstmpanel.com — a host that is not one of the two servers you were given access to. Confirming where the mobile API actually runs is the single most important open question. See Findings.

Request flow

📱 Mobile apps iOS + Android (RN) 🌐 Web browser marketing + dashboard Cloudflare CDN / DNS PRODUCTION DROPLET · 161.35.191.47 Nginx :80/:443 TLS termination Varnish :6081 HTTP cache PHP-FPM 8.0 / 8.3 / 8.4 / 8.5 Apps WordPress ×2 Laravel api + dash MySQL 8 :3306 4 local databases Redis / Memcached sessions / cache DO Managed MySQL :25060 (dashboard prod data) ❓ hatch-social.cstmpanel.com the API the shipping mobile app actually calls — host unknown / not in access list mobile app baseUrl →

How each surface talks to the backend

SurfaceCodeTalks toDatabase
iPhone / Android app HSF-Code (React Native) https://hatch-social.cstmpanel.com unknown host Whatever that host uses — unconfirmed
Admin dashboard Laravel (redesigned-spoon-Dashboard) dash.hatch.social on prod droplet DO Managed MySQL hatch-social (prod)
API endpoint on prod Same Laravel codebase api.hatch.social on prod droplet Local MySQL hatch-social-test test DB
Marketing website WordPress + Elementor hatch.social on prod droplet Local MySQL hatch
Secondary web build WordPress web.hatch.social on prod droplet Local MySQL hatch-web

The backend is one app, deployed twice

The Laravel 9 codebase in redesigned-spoon-Dashboard is a single application that exposes both a JSON API (consumed by the mobile apps) and a server-rendered admin dashboard (Blade views under routes/web.php). On the production droplet it is deployed as two separate vhosts:

  • api.hatch.social — PHP 8.5, pointed at the local test database.
  • dash.hatch.social — PHP 8.4, pointed at the DigitalOcean production managed database, and adds barryvdh/laravel-dompdf for PDF generation.

Third-party services wired into this backend: Firebase (push/auth), Stripe + Laravel Cashier (subscriptions/payments), Agora (video/audio calls), Pusher (real-time), Twilio (SMS), and Google APIs.

See Production Server for the full host inventory and Databases for the data layer.