<RajVardhan/>
Back to catalog
Full Stack
2025-11-15

HostelBites — Campus Food Delivery Platform

A comprehensive, multi-role food delivery monorepo featuring a Node.js backend and four React Progressive Web Apps (PWA) funded by AIC-RRU, serving 300+ active users in the first month.

Inspect Source CodeLaunch Live Site
HostelBites — Campus Food Delivery Platform Preview

The Problem

Students living in university hostels face difficulties ordering food late at night or managing meal bookings from local campus canteens and stores.

The Solution

Founded and engineered HostelBites, a campus food delivery ecosystem. The project secured official incubation and funding from AIC-RRU (Atal Incubation Centre - Rashtriya Raksha University) and reached 300+ active users in its first month.

Key Capabilities
  • Monorepo structure containing separate Customer (Port 5300), Store (Port 5302), Delivery (Port 5303), and Admin (Port 5301) React PWAs.
  • Double-verification OTP flow: Store-to-Rider OTP handshake on pickup and Rider-to-Customer OTP handshake on delivery.
  • Gender-sensitive delivery routing: Automatic order filtering where female riders deliver to girls' hostels and male riders to boys' hostels.
  • Real-time updates using Socket.io and native-like push notifications via Firebase Cloud Messaging (FCM).
  • Integrated Razorpay Payment Gateway with secure payment verification and webhook event listeners.
  • Secure wallet withdrawals with OTP verification, 10-minute expiry window, and invalid attempt capping.

Technology Stack

React (PWA)Node.jsExpress.jsMongoDBSocket.ioFirebase (FCM)RazorpayNginxPM2Ubuntu VPS

Architecture & Detailed Implementation

HostelBites is designed as a decoupled, multi-client monorepo structure communicating with a unified backend API:

  1. Backend Service (backend/): Node.js and Express.js REST API providing secure JWT authentication, role-based authorization (Customer, Store, Delivery, Admin), database management, and Webhook processing.
  2. Frontend Applications (frontend/):
    • Customer App (frontend/customer): Allows students to browse canteen menus, place orders, make online payments, and track deliveries in real-time.
    • Store App (frontend/store): Enables canteen owners to manage active orders, update menu listings, and verify rider pickups.
    • Delivery Partner App (frontend/delivery): Enables student riders to view available orders matching their campus and gender, navigate, and verify deliveries.
    • Admin Dashboard (frontend/admin): Gives campus administrators complete control over user roles, merchant settings, and platform configuration.
                  +---------------------------------------+
                  |           Nginx Reverse Proxy         |
                  +---------------------------------------+
                     /         |             \          \
                    /          |              \          \
             (Port 5300)  (Port 5302)   (Port 5303)  (Port 5301)
                  v            v              v          v
            +----------+ +-----------+ +----------+ +----------+
            | Customer | |   Store   | | Delivery | |  Admin   |
            |   PWA    | |    PWA    | |   PWA    | | Dashboard|
            +----------+ +-----------+ +----------+ +----------+
                  \            |              /          /
                   \           |             /          /
                    +--> [Node.js / Express API] <-----+
                             (Port 5000 / PM2)
                                   |
                                   v
                             [MongoDB Atlas]

Key Security & Logic Implementations

  • Dual OTP Handshake Verification:
    • Pickup Stage: The canteen owner generates a verification OTP which must be entered by the delivery rider to authorize order pickup.
    • Delivery Stage: The delivery rider generates a verification OTP which must be entered by the customer to confirm delivery.
    • Security: Prevents unauthorized order pickups and fraudulent delivery claims.
  • Gender-Sensitive Delivery Filters:
    To respect hostel security rules, male riders are automatically filtered out from accepting deliveries bound for girls' hostels, while female riders have full access.
  • Razorpay Webhook Integration:
    Configured secure Webhook endpoints (/api/v1/payment/webhook) with signature verification (Razorpay.validateWebhookSignature) to handle asynchronous payment success (payment.captured) and ensure orders are never processed without successful capture.
  • Rate Limiting & Safety:
    Added API rate limiting on OTP generation and wallet withdrawal requests. Account actions are blocked after 3 consecutive invalid OTP attempts.

Lessons Learned & Key Takeaways

Building a multi-role production monorepo taught me how to manage workspace dependencies, orchestrate real-time messaging with Socket.io, implement multi-factor OTP verification flows, handle secure payment webhooks, and manage production servers using Nginx and PM2 on an Ubuntu VPS.