wacrm // system architecture

Self-hostable WhatsApp CRM — Next.js 16 App Router monolith over a Supabase Postgres backend, talking to Meta Cloud API for WhatsApp and to OpenAI / Anthropic (bring-your-own-key) for AI drafts and RAG.
Runtime · Node.js 20 · Next 16.2
Deploy · Hostinger Managed Node.js
DB · Supabase Postgres + RLS
request / data
inbound webhook
AI · retrieval
Client · Edge
▣ Browser dashboard
Agents in the shared inbox — React 19 UI, Supabase Realtime WSS for live messages & presence.
React 19 Tailwind v4 shadcn/ui
☎ WhatsApp customer
End user chatting via WhatsApp — never touches wacrm directly; traffic flows through Meta.
◈ Hostinger CDN / TLS
LiteSpeed edge + free Let’s Encrypt on the customer domain. HSTS + CSP-Report-Only baseline.
HSTS CSP DDoS
HTTPS cookies · WSS
Application (Next.js 16)
◐ Auth middleware
Every request runs src/middleware.ts — Supabase SSR cookie session, refresh-token rotation, protected-path redirects.
@supabase/ssr
▤ App Router pages
Server-rendered dashboard: /inbox, /contacts, /pipelines, /broadcasts, /automations, /flows, /settings.
RSC Server Actions
⇄ Internal API routes
/api/whatsapp/* send + templates + config, /api/ai/* drafts & knowledge, /api/automations, /api/flows, /api/account/*.
⚿ Public REST API
/api/v1/{contacts,conversations,messages,broadcasts,webhooks} — scoped, SHA-256-hashed API keys, per-account rate limit.
Bearer rate-limit
✦ Automations & Flows engines
In-process step runners — triggers on inbound / new contact / keyword / schedule; Flows drive interactive WhatsApp button & list replies.
@xyflow/react dagre
SQL · RLS Realtime WSS
Data & Processing
◫ Supabase Postgres
30 idempotent migrations — accounts, contacts, conversations, messages, pipelines, broadcasts, automations, flows, api_keys, webhook_endpoints, ai_configs, ai_knowledge.
RLS on every table pgvector tsvector FTS
✎ Supabase Auth
Email/password + magic-link invites. Server routes use service-role key for webhook + engine writes that bypass RLS.
▦ Supabase Storage
Buckets chat-media, flow-media, profile-avatars — account-scoped RLS paths account-<uuid>/…, 16 MB cap.
◔ Cron pinger
GET /api/automations/cron drains pending Wait steps — external scheduler hits it with AUTOMATION_CRON_SECRET.
✧ Realtime channel
Supabase Realtime (postgres_changes) fans row updates to inbox, presence, notifications — best-effort with reconnect resync.
HTTPS embed · retrieve
External services
◉ Meta Cloud API
graph.facebook.com/v22.0 — send messages, upload media, submit templates. Access token AES-256-GCM-encrypted at rest.
HMAC-SHA256 verify
✺ OpenAI
api.openai.com/v1/chat/completions + /embeddings — drafts, auto-reply, text-embedding-3-small for RAG.
BYO key
✺ Anthropic
api.anthropic.com/v1/messages — drafts + auto-reply. No embeddings API; lexical FTS path only.
BYO key
➜ Customer webhook receivers
Outbound event webhooks registered per account — HMAC-signed payloads, SSRF-guarded, secret encrypted at rest.
INFRA
Node.js 20
engines ≥20 · npm
Hostinger
Managed Node.js · Git push to main
LiteSpeed + CDN
edge cache · s-maxage=300, SWR
Supabase
Postgres · Auth · Storage · Realtime
GitHub Actions
lint · typecheck · vitest · build
Env in hPanel
no .env on server · live logs
Stack — full component list
Concrete technologies grouped by layer (versions from package.json and migrations)

Frontend

  • Next.js 16.2.6 (App Router)
  • React 19.2.4 + React-DOM 19.2.4
  • TypeScript 6
  • Tailwind CSS v4 + tw-animate
  • shadcn/ui + @base-ui/react
  • lucide-react icons
  • recharts (dashboards)
  • sonner (toasts)

Backend

  • Next.js Route Handlers
  • Server Actions (dashboard)
  • Edge middleware (auth)
  • @supabase/ssr 0.12
  • @supabase/supabase-js 2.107
  • AES-256-GCM encryption (node:crypto)
  • SHA-256 API-key hashing
  • HMAC-SHA256 signing/verify

Data

  • Supabase Postgres
  • Row-Level Security on every table
  • 30 SQL migrations (idempotent)
  • pgvector (1536-dim embeddings)
  • tsvector full-text search
  • uuid-ossp
  • Supabase Storage buckets

Realtime · Async

  • Supabase Realtime (WSS)
  • postgres_changes subscriptions
  • after() deferred fan-out
  • External cron → /api/automations/cron
  • In-process Automations engine
  • In-process Flows engine
  • Presence (member_presence table)

Integrations

  • Meta WhatsApp Cloud API v22.0
  • OpenAI Chat + Embeddings
  • Anthropic Messages
  • Outbound webhooks (HMAC + SSRF guard)
  • opus-recorder (voice notes)
  • CSV contact import

UI · Builders

  • @xyflow/react (flow & automation canvas)
  • @dagrejs/dagre (auto-layout)
  • @dnd-kit (kanban pipelines)
  • date-fns 4
  • class-variance-authority
  • clsx + tailwind-merge

DevOps

  • GitHub Actions (ci.yml)
  • ESLint 9 + eslint-config-next
  • Prettier 3 + tailwind plugin
  • vitest 4 (unit tests)
  • tsc --noEmit typecheck
  • Dependabot
  • Hostinger Git deploy · hPanel env
Generated from repo evidence · docs/architecture-diagram.html · single-file, no external requests · self-hosts anywhere Node.js does.