Chaloo

Chaloo matches drivers and passengers who are heading the same way, so they can split the cost of the trip. It launched on hosted Supabase.

I wanted the backend on infrastructure I control. The move couldn't mean rewriting the app's security rules, and it couldn't put the live app at risk.

• A Postgres 17 and PostGIS database in Docker, loaded with the live schema through small compatibility shims. The existing 35 row-level security policies still decide who can see what.
• A Node 22 and Fastify API that runs every request as the caller's database role, the same way Supabase does. It covers sign-in (Google, Apple, phone and email), realtime updates over WebSockets filtered by the same policies, push notifications through Firebase Cloud Messaging, and scheduled jobs such as ride reminders.
• Fixes for bugs that also exist in the live app: reviews blocked by a trigger, broken ride-tracking links and a missing nearby-search function.
• An 82-check end-to-end smoke test that uses throwaway accounts and cleans up after itself, plus a security check script. Both run against the new stack before each change.
• A beta build of the app pointed at api.chalooapp.com, built by Xcode Cloud and shipped to TestFlight.

The self-hosted backend is running in beta (TestFlight build 1.0.9). Google and Apple sign-in and push notifications are confirmed on a real iPhone.

The public app still runs on Supabase. It moves over once the beta has been fully tested on devices.

See it live: chalooapp.com.