About the project
A VPN service with subscriptions, payments, device management and automated access provisioning.
Project / 03
RYFT VPN
A VPN service with subscriptions, payments, device management and automated access provisioning.
My contribution
- Architected and implemented the VPN backend: automated billing, subscription lifecycle, client device tracking, and access enforcement.
- Integrated Marzban API and Xray-core nodes for automated credential provisioning, dynamic key revocation, and bandwidth telemetry.
- Configured ARQ queues for node synchronization with automated retry routines on network failures.
Python, FastAPI, PostgreSQL, Redis, ARQ, Marzban API, Xray-core, Docker
02 / Product surfaces
Three product surfaces
The customer Mini App, operational admin dashboard and backend control plane form one product.
Telegram Mini App
4 mobile screens · 430 × 932Operations dashboard
4 desktop screens · 1920 × 1080Captured from the real built Vue applications with representative local mock data. Core, PostgreSQL, Redis, Marzban and Xray were not started.
03 / Case study
A complete VPN subscription platform
RYFT combines a customer Telegram Mini App, a dedicated administration application and a Python control plane that owns billing, entitlements and key provisioning.
Product scope
Telegram and web authentication with linked identities
Plans, promo codes, Platega checkout and webhook fulfillment
Device-limited subscriptions and independently revocable VPN keys
Marzban provisioning with Core-owned public subscription URLs
Admin operations, support, partners, notifications and audit
Production routing, metrics, logs, alerts and encrypted backups
Engineering decisions
Core owns product truth
PostgreSQL stores users, payment orders, subscriptions, device keys and provisioning operations. Frontends consume typed API contracts rather than Marzban state.
Provisioning is recoverable
ARQ workers process expiry, reconciliation and replay. Durable idempotent operations survive provider failures.
Control plane and data plane are separate
Core decides who has access. Marzban manages credentials and hosts; Xray serves VLESS TCP REALITY traffic.
Three deployable repositories
Core, Mini App and Admin are built separately behind one Traefik edge while remaining one product.
Repository structure
Three repositories with explicit ownership boundaries.
RYFT / PLATFORM
core/backend, workers and production infrastructure
apps/backend/src/core/config · database · security · Dishka
apps/backend/src/modules/users/auth · identities · admin access
apps/backend/src/modules/billing/plans · payments · subscriptions · promos
apps/backend/src/modules/devices/device limits · VPN keys · subscription URLs
apps/backend/src/modules/provisioning/Marzban operations · reconciliation
apps/backend/src/modules/support/tickets · messages · attachments
apps/backend/src/modules/partners/referrals · commissions · payouts
apps/backend/src/presentation/TMA API · admin API · webhooks · health
infra/Traefik · Marzban/Xray · monitoring · backups
tma-frontend/customer Vue application
src/pages/home · devices · subscription · servers · profile
src/api/ + src/stores/typed clients and product state
admin-frontend/operations Vue application
src/pages/dashboard · users · payments · servers · ops
src/api/admin endpoints and WebSocket client
06 / System architecture
Open interactive diagram ↗System architecture
Original project documentation in Russian