Comanda started as a checkout system for a single event: order on your phone, pay with TWINT, pick your food up by QR code. The event turned out to be monthly, other organizers started asking, and the single-event codebase became a multi-tenant platform where each organizer gets their own shop, branding, domain and data.

The hard requirement

Event networks are unreliable and queues are unforgiving. The system is built so the critical path survives bad connectivity: the pickup QR is a signed binary payload (Ed25519), so stations can verify and redeem orders completely offline, writing to a local ledger that syncs back when the network returns. Staff enroll a station by opening a QR link on whatever phone they have in their pocket.

Architecture

• Backend in Go (Ent, Chi, OpenAPI-first with generated handlers). Tenant isolation lives in the database: every table carries a tenant id and Postgres Row Level Security enforces it per request-transaction, with separate privileged and restricted DB roles. An application bug can't cross tenants.
• Web in Next.js. Tenants resolve by hostname; organizers bring their own domains and certificates are issued automatically.
• POS is a thin Kotlin shell around the web app: a WebView with JS bridges to the SumUp card reader SDK and to thermal printers driven over a raw Bluetooth socket with a hand-rolled raster protocol, thirty-franc sticker printers doing the job of commercial receipt hardware.
• Payments: TWINT and cards via per-tenant provider credentials (encrypted at rest), plus a refund engine that pays back through the original payment method. Deposits on reusable cups are tracked as order lines and refunded at return.
• Infra: K3s on Hetzner, gitops via ArgoCD, PgBouncer in front of Postgres, images pinned by commit SHA. Grafana, Loki and Sentry for observability.

In production

The platform runs a monthly recurring event and carried a five-day festival with food, coffee and a merch shop: 4,051 orders, 6,382 items, a peak of 16 orders per minute, 415,000 requests. Stock is guarded by row locks at checkout, so the busiest lunch hour rejected sold-out items cleanly instead of overselling. Load-tested with k6 to roughly 200 orders per second, about 750× the festival's real peak. Two fixes shipped mid-event without downtime.