Airbnb Clone
An enterprise-grade, distributed lodging and hospitality reservation platform engineered as event-driven microservices. Built with Go, Node.js, TypeScript, MySQL, Redis, Prisma, and Sequelize, this platform demonstrates production-ready patterns for distributed mutual exclusion, idempotent transactions, asynchronous event streaming, and edge API gateway routing.
Service architecture topology and data pipeline flow.
Zero-Trust Edge Reverse Proxy and Authentication Gateway
A Go-based Chi gateway that terminates client traffic, enforces rate limiting, verifies JWTs, strips spoofed identity headers, and routes requests to downstream services via connection pooling.
Distributed Concurrency Control and Double-Booking Prevention
A Redis Redlock distributed locking engine that eliminates race conditions and enforces date-interval intersection checks to prevent overlapping reservation
Idempotent Reservation Finalization
An atomic Prisma transaction lifecycle utilizing idempotency keys to guarantee booking confirmations and payment updates cannot be duplicated or replayed.
Asynchronous Event-Driven Transactional Notifications
A BullMQ worker pipeline that validates payloads with Zod schemas, compiles Handlebars email templates, and reliably delivers messages without blocking core database transactions.
Database-per-Service Isolation Boundary
Each microservice strictly owns its dedicated relational database schema (airbnb_apiGateway, airbnb_apartment, and airbnb_booking_dev). Direct cross-database joins are eliminated in favor of clean RESTful interfaces and asynchronous events, preventing data coupling and enabling independent database scaling and schema migrations.
Distributed Concurrency with the Redlock Algorithm
The Booking Service eliminates race conditions by acquiring distributed locks on property:<id> using Redis Redlock prior to checking reservation date overlaps. Critical sections execute within a guaranteed try...finally block to ensure locks are never orphaned, converting concurrent booking collisions into immediate, semantic HTTP 409 Conflict responses.
Transaction-First Event Publishing Discipline
Side effects like transactional email delivery are dispatched to BullMQ queues only after Prisma transactions successfully commit, bounded by isolated try/catch handlers. This ensures external messaging infrastructure failures or SMTP rate limits can never abort or roll back confirmed database reservations.
Atomic Idempotency State Finalization
The booking confirmation workflow protects payment and reservation lifecycles through an atomic idempotency model executed inside a Prisma $transaction. Checking key existence, updating the reservation to confirmed, and setting the idempotency record to finalized occur in a single atomic database operation, ensuring safe replay handling across network retries
Concurrent reservation requests for the same listing created race conditions where simultaneous database queries observed the dates as available, resulting in conflicting bookings committing to the database.
nforced mutual exclusion using Redis Redlock distributed locking on property:<id> paired with interval intersection queries inside a guaranteed try...finally block, eliminating double-booking collisions and returning deterministic HTTP 409 Conflict responses.
Downstream microservices rely on X-User-ID and X-User-Email headers for authorization and ownership verification, leaving the system vulnerable to external clients injecting forged headers to impersonate hosts or guests.
Configured an anti-spoofing reverse proxy pipeline in the Go API Gateway that unconditionally strips incoming client identity headers before extracting verified claims from valid JWT tokens and re-injecting trusted headers downstream.
Local Reproduction (1 Command)
Clone the repository and boot the full environment (services, datastore, metrics) via Docker Compose: