One backend, many brands, no leaks between them
A multi-tenant headless platform, and the WordPress-to-Astro migrations it serves.
- Role
- My initiative; architecture and build
- Time
- 4 months
- Stack
- Next.js · Postgres · Prisma · Astro
- Team
- Me, plus a contributor on one site
Problem
Several brands lived on separate WordPress installs that were slow and hard to keep consistent. They needed one source of truth, without one brand ever seeing another's data.
Constraints
- Isolation has to hold even when application code is wrong.
- The sites have to stay up when the API is down.
- Moving off WordPress cannot cost search traffic.
Decisions
- Enforced tenant isolation in four layers (a scoped client that fails closed, lint bans, database triggers on every relation and a guard test per relation), after composite foreign keys broke dozens of tests under nested creates and were dropped.
- Froze the API contract as additive-only and copied the client kit byte for byte into each site, with checksum and drift checks.
- Gave the sites a validated snapshot fallback and a recovery canary, so a page cached while the API was down heals itself.
- Built redirects from four sources (sitemaps, the Wayback Machine, the old redirect plugin and Search Console) and made the cutover script fail on any redirect that lands on a 404.
Outcome
The sites moved off WordPress onto one platform, faster and with one place to change content.
- Mobile LCP 5.7 s → 1.7 s on one site
- Best Practices 78 → 100
- About 4,300 unit and 400 integration tests
Credits
One of the sites built on the platform had another contributor.